ServiceNow · Utah, Vancouver, and Washington DC Now Platform

CVE-2024-4879

Jelly Template Injection Vulnerability in ServiceNow UI Macros

Exploited in attacks Critical 9.3 Attack chance: >99.9%

What it is

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

CISA: ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: August 19, 2024

Added to the CISA list: July 29, 2024
Published: July 10, 2024
Severity: Critical 9.3 CVSS 4.0
Chance of attacks in the next 30 days (EPSS): >99.9% in the top 0.1% of all known vulnerabilities
Weakness: CWE-1287
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from ServiceNow

Added	Vulnerability	Product	Severity	Attack chance
Jul 29, 2024	Incomplete List of Disallowed InputsCVE-2024-5217	Utah, Vancouver, and Washington DC Now Platform	Critical 9.2	99.6%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.