Log in Start free

Vulnerability · Published Oct 29, 2024 · Assigned by SN

CVE-2024-8924Unauthenticated Blind SQL Injection in Core Platform

High 7.5

In plain English

A high-severity SQL injection in Now Platform from ServiceNow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 57.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.

Affected products (as reported)

VendorProductVersions
ServiceNow Now Platform 0 – before Utah Patch 10b Hot Fix 30 – before Vancouver Patch 8 Hot Fix 50 – before Vancouver Patch 9 Hot Fix 3b0 – before Vancouver Patch 10 Hot Fix 20 – before Washington DC Patch 4 Hot Fix 2b0 – before Washington DC Patch 5 Hot Fix 60 – before Washington DC Patch 6 Hot Fix 10 – before Washington DC Patch 7

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References