Critical severity · published Oct 29, 2024
CVE-2024-8923
Sandbox Escape in Now Platform
10.0
CVSS
1.1%
EPSS
No
On KEV
Description
ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NP
Now Platform · ServiceNow
before Vancouver Patch 9 Hot Fix 2a; before Vancouver Patch 10; before Washington DC Patch 4 Hot Fix 1a; before Washington DC Patch 5; before Xanadu GA Release · source: vendor
SE
Servicenow · Servicenow
xanadu; xanadu; washington_dc; washington_dc; washington_dc; washington_dc; +34 more · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8923
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8923
Vendor Advisory
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1706070
More from Now Platform
9.8
CVE-2024-5217
Incomplete Input Validation in GlideExpression Script
9.8
CVE-2024-4879
Jelly Template Injection Vulnerability in ServiceNow UI Macros
8.2
CVE-2025-3648
Data Inference in Now Platform via Conditional ACLs
7.5
CVE-2024-8924
Unauthenticated Blind SQL Injection in Core Platform
6.5
CVE-2025-0337
Authorization bypass in Now Platform