CVE-2024-5890

HTML Injection in the Assessment plugin

State: Published
Severity: 5.1 Medium
Published: Dec 2, 2024
Updated: Dec 2, 2024
Reserved: Jun 12, 2024

Description

ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.

ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	SN
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	SN

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

Product	Versions
Now PlatformServiceNow	before Utah Patch 8 Hot Fix 1Affected before Vancouver Patch 10Affected before Vancouver Patch 9Affected before Washington DC Early AccessAffected

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1710511

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.