Summary
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in ServiceNow Now Platform ausnutzen, um beliebigen Code im Kontext des Dienstes auszuführen oder vertrauliche Informationen offenzulegen.
Product
Die ServiceNow Now Platform ist eine Cloud-basierte Plattform, die Unternehmen bei der Automatisierung und Verwaltung ihrer Geschäftsprozesse unterstützt
Vulnerabilities 3
-
Critical 9.8
Jelly Template Injection Vulnerability in ServiceNow UI Macros
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. Servi…
KEV Jul 29, 2024 -
Critical 9.8
Incomplete Input Validation in GlideExpression Script
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now P…
KEV Jul 29, 2024 -
Medium 4.9CVE-2024-5178 EPSS 34%
Incomplete Input Validation in SecurelyAccess API
ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerability could allow an administrative user to gain unauthorized access to sensitive files on the web a…
Revision history
-
#2
Exploit für CVE-2024-4879 aufgenommen
-
#1
Initiale Fassung
References
-
ServiceNow Posture vom 2024-07-10
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154
-
ServiceNow Posture vom 2024-07-10
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313
-
ServiceNow Posture vom 2024-07-10
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648312
-
Exploit CVE-2024-4879 vom 2024-07-17
https://github.com/Praison001/CVE-2024-4879-ServiceNow/blob/main/exploit.py