Medium severity · published Jul 10, 2024
CVE-2024-5178
Incomplete Input Validation in SecurelyAccess API
4.9
CVSS
33.6%
EPSS
No
On KEV
Description
ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerability could allow an administrative user to gain unauthorized access to sensitive files on the web application server. The vulnerability is addressed in the listed patches and hot fixes, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)33.6% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NP
Now Platform · ServiceNow
before Utah Patch 10 Hot Fix 3; before Utah Patch 10a Hot Fix 2; before Utah Patch 10b Hot Fix 1; before Vancouver Patch 6 Hot Fix 2; before Vancouver Patch 7 Hot Fix 3b; before Vancouver Patch 8 Hot Fix 4; +6 more · source: vendor
Affected product
NP
Now Platform
ServiceNow
More from Now Platform
9.8
CVE-2024-5217
Incomplete Input Validation in GlideExpression Script
9.8
CVE-2024-4879
Jelly Template Injection Vulnerability in ServiceNow UI Macros
10.0
CVE-2024-8923
Sandbox Escape in Now Platform
8.2
CVE-2025-3648
Data Inference in Now Platform via Conditional ACLs
7.5
CVE-2024-8924
Unauthenticated Blind SQL Injection in Core Platform