CVE-2024-5890

published 2024-12-02

CVE-2024-5890: ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an…

Priority P4 19 medium 4.3 CVSS 3.1

AV N AC L PR N UI R S U C N I L A N

ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.

ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
servicenow	now_platform	< Utah Patch 8 Hot Fix 1	Utah Patch 8 Hot Fix 1
servicenow	now_platform	< Vancouver Patch 10	Vancouver Patch 10
servicenow	now_platform	< Vancouver Patch 9	Vancouver Patch 9
servicenow	now_platform	< Washington DC Early Access	Washington DC Early Access

CVSS provenance

nvd v3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

nvd v4.0 5.1 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79