CVE-2024-5178

CVE Enrichment

CVSS: 6.9 MEDIUM
EPSS: 33.59%
EPSS Percentile: 98.39%
CISA KEV: Not listed

Description

ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerability could allow an administrative user to gain unauthorized access to sensitive files on the web application server. The vulnerability is addressed in the listed patches and hot fixes, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 11-Jul-2024 00:15
Last Modified: 17-Jun-2026 15:15
EPSS Date: 2026-10-22
CWE: CWE-184

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:H /
                            UI:N /
                            VC:H /
                            VI:N /
                            VA:N /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

Last enrichment sync: 02-Nov-2026 07:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Two years ago, threat actors chained three ServiceNow flaws (CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217) using publicly available exploits to breach private firms and government agencies worldwide in data theft ServiceNow Patches Three Critical AI Platform Vulnerabilities

CVE (7)

MITRE ATT&CK (1)

Vendors (1)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.