https://pwn.watch/t/servicenow Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Mon, 29 Jul 2024 00:00:00 GMT https://pwn.watch/i/servicenow-utah-vancouver-and-washington-cve-2024-4879-5217 https://pwn.watch/i/servicenow-utah-vancouver-and-washington-cve-2024-4879-5217 Mon, 29 Jul 2024 00:00:00 GMT critical <p>CVE-2024-4879: ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely. CVE-2024-5217: ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely. Added to the CISA KEV catalog on 2024-07-29.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-07-29: CISA added CVE-2024-4879 to the KEV catalog (federal deadline 2024-08-19) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-07-29: CISA added CVE-2024-5217 to the KEV catalog (federal deadline 2024-08-19) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-07-10: CVE-2024-4879 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-4879">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-4879, CVE-2024-5217</p>