CVE-2024-8923

Description

ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.

Reserved 2024-09-16 | Published 2024-10-29 | Updated 2024-10-31 | Assigner SN

Problem types

CWE-94 Improper Control of Generation of Code ('Code Injection')

Product status

Default status
unaffected

Any version before Vancouver Patch 9 Hot Fix 2a
affected

Any version before Vancouver Patch 10
affected

Any version before Washington DC Patch 4 Hot Fix 1a
affected

Any version before Washington DC Patch 5
affected

Any version before Xanadu GA Release
affected

Credits

T-Mobile finder

References

support.servicenow.com/...cle_view&sysparm_article=KB1706070

cve.org (CVE-2024-8923)

nvd.nist.gov (CVE-2024-8923)

Download JSON