← Zuruck zu CVEs

CVE-2024-4879

CRITICALCISA KEV

9.8

Beschreibung

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht7/10/2024

Zuletzt geandert11/3/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerServiceNow

ProduktUtah, Vancouver, and Washington DC Now Platform

SchwachstellennameServiceNow Improper Input Validation Vulnerability

KEV Aufnahmedatum2024-07-29

Behebungsfrist2024-08-19

Ransomware-NutzungUnknown

Betroffene Produkte

servicenow:servicenow

Schwachen (CWE)

CWE-1287

Referenzen

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293(psirt@servicenow.com)

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154(psirt@servicenow.com)

https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit(psirt@servicenow.com)

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293(af854a3a-2127-422b-91ae-364da2661108)

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154(af854a3a-2127-422b-91ae-364da2661108)

https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4879(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.