report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HServicenow
APPServicenowjakarta
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
Related vulnerabilities
CVE-2024-5217CRITICAL9.2⚠ KEVPL ✓same product
Krytyczna podatność RCE w ServiceNow Now Platform (input validation)
CVE-2024-4879CRITICAL9.3⚠ KEVPL ✓same product
ServiceNow Now Platform — zdalny RCE bez uwierzytelnienia (input validation)
CVE-2024-8923CRITICAL9.3PL ✓same product
Zdalne wykonanie kodu w ServiceNow Now Platform (RCE bez uwierzytelnienia)
CVE-2022-43684CRITICAL9.9PL ✓same product
ServiceNow: pominięcie kontroli dostępu ACL umożliwia dostęp do wrażliwych danych
CVE-2024-8924HIGH8.7same product
ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vul...