ServiceNow Incomplete List of Disallowed Inputs Vulnerability
ServiceNow · Utah, Vancouver, and Washington DC Now Platform
Date added (CISA)
2024-07-29
Remediation due
2024-08-19
Known ransomware use
Not indicated
Remediation priority
P2 — past CISA due date
Description
ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.