HIGH🇵🇱 Wersja polska

CVE-2024-8924

CVSS 8.7v4.0pub. 2024-10-29upd. 2024-11-27

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Servicenow

    APP
    Servicenow
    vancouverwashington_dcxanadu
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2024-5217CRITICAL9.2⚠ KEVPL ✓ten sam produkt

Krytyczna podatność RCE w ServiceNow Now Platform (input validation)

CVE-2024-4879CRITICAL9.3⚠ KEVPL ✓ten sam produkt

ServiceNow Now Platform — zdalny RCE bez uwierzytelnienia (input validation)

CVE-2024-8923CRITICAL9.3PL ✓ten sam produkt

Zdalne wykonanie kodu w ServiceNow Now Platform (RCE bez uwierzytelnienia)

CVE-2022-43684CRITICAL9.9ten sam produkt

ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in Servi...

CVE-2018-7748HIGH8.8ten sam produkt

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrar...