CVE-2024-8923

Sandbox Escape in Now Platform

State: Published
Severity: 9.3 Critical
Published: Oct 29, 2024
Updated: Oct 31, 2024
Reserved: Sep 16, 2024

Description

ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	SN
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	SN

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
Now PlatformServiceNow	before Vancouver Patch 9 Hot Fix 2aAffected before Vancouver Patch 10Affected before Washington DC Patch 4 Hot Fix 1aAffected before Washington DC Patch 5Affected before Xanadu GA ReleaseAffected

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1706070

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.