CVE-2024-5217

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-184CWE-697

Affected software

VendorProductVersions
ServiceNowNow Platform< Utah Patch 10 Hot Fix 3; < Utah Patch 10a Hot Fix 2; < Utah Patch 10b Hot Fix 1; < Vancouver Patch 6 Hot Fix 2; < Vancouver Patch 7 Hot Fix 3b; < Vancouver Patch 8 Hot Fix 4; < Vancouver Patch 9 Hot Fix 1; < Vancouver Patch 10; < Washington DC Patch 1 Hot Fix 3b; < Washington DC Patch 2 Hot Fix 2; < Washington DC Patch 3 Hot Fix 2; < Washington DC Patch 4; < Washington DC Patch 5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5
servicenowservicenow< utah_patch_10_hot_fix_3; < utah_patch_10a_hot_fix_2; < utah_patch_10b_hot_fix_1; < vancouver_patch_6_hot_fix_2; < vancouver_patch_7_hot_fix_3b; < vancouver_patch_8_hot_fix_4; < vancouver_patch_9_hot_fix_1; < vancouver_patch_10; < washington_dc_patch_1_hot_fix_3b; < washington_dc_patch_2_hot_fix_2; < washington_dc_patch_3_hot_fix_2; < washington_dc_patch_4; < washington_dc_patch_5

References

Timeline

Published
Jul 10, 2024
Last modified
Jun 17, 2026
Added to CISA KEV
Jul 29, 2024
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-52186.4The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload featuCVE-2024-52195.4The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions CVE-2024-52205.4The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, aCVE-2024-52215.4The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and inCVE-2024-52225.4The Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. plugin for WordPress is vulnerablCVE-2024-52236.4The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pCVE-2024-52245.4The Easy Social Like Box – Popup – Sidebar Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cardozCVE-2024-52257.2An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint. The vulnerabCVE-2024-52265.4The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all CVE-2024-522684.8Cross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0. If this vulnerability is exploited, aCVE-2024-522698.1User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignorCVE-2024-52277.5TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent atta
CVE-2024-5217: Critical severity, CVSS 9.8 | Vulnix