CVE-2024-5217

CVE Enrichment

CVSS: 9.2 CRITICAL
EPSS: 99.63%
EPSS Percentile: 99.95%
CISA KEV: YES — Known Exploited Vulnerability

Description

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 11-Jul-2024 00:15
Last Modified: 17-Jun-2026 15:15
EPSS Date: 2026-10-22
CWE: CWE-184, CWE-697

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:P /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CISA KEV Details

Date Added: 2024-07-29
Remediation Due: 2024-08-19
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313; https://nvd.nist.gov/vuln/detail/CVE-2024-5217

Affected Products / Versions

servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:early_availability:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_10:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_10a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_10a_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_10b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_4:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_5:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_5:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_5_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_6:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_7:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_7a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_7b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_8:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_8_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_9:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:-:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_1_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_4:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_2b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_5:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_5_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_6:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_6_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_3a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_4:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_9:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:-:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5:*:*:*:*:*:*

References

Last enrichment sync: 02-Nov-2026 07:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Two years ago, threat actors chained three ServiceNow flaws (CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217) using publicly available exploits to breach private firms and government agencies worldwide in data theft ServiceNow Patches Three Critical AI Platform Vulnerabilities

CVE (7)

MITRE ATT&CK (1)

Vendors (1)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.