On this page

Atomicorp WAF Research Note: CVE-2024-5217

ServiceNow - Incomplete Input Validation

CVE Details

Already protected by existing Atomicorp WAF rules
Protection status: Understanding Atomicorp WAF Protection Status
CVE: CVE-2024-5217
Name: ServiceNow - Incomplete Input Validation
Severity: Critical
CVSS: 9.2 (v4.0) (Critical)
CVSS version: 4.0
CVSS source: SN CNA
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector: Network
- Attack complexity: Low
- Attack requirements: Present
- Privileges required: None
- User interaction: None
- Vulnerable-system confidentiality: High
- Vulnerable-system integrity: High
- Vulnerable-system availability: High
- Subsequent-system confidentiality: None
- Subsequent-system integrity: None
- Subsequent-system availability: None
- Scope: X
CWE: CWE-184 — Incomplete List of Disallowed Inputs, CWE-697 — Incorrect Comparison
Related CAPEC attack patterns (via MITRE CWE relationships): CAPEC-10 (opens in a new tab) , CAPEC-120 (opens in a new tab) , CAPEC-14 (opens in a new tab) , CAPEC-15 (opens in a new tab) , CAPEC-182 (opens in a new tab) , CAPEC-24 (opens in a new tab) , CAPEC-267 (opens in a new tab) , CAPEC-3 (opens in a new tab) , CAPEC-41 (opens in a new tab) , CAPEC-43 (opens in a new tab) , CAPEC-44 (opens in a new tab) , CAPEC-45 (opens in a new tab) , CAPEC-46 (opens in a new tab) , CAPEC-47 (opens in a new tab) , CAPEC-52 (opens in a new tab) , CAPEC-53 (opens in a new tab) , CAPEC-6 (opens in a new tab) , CAPEC-64 (opens in a new tab) , CAPEC-67 (opens in a new tab) , CAPEC-7 (opens in a new tab) , CAPEC-71 (opens in a new tab) , CAPEC-73 (opens in a new tab) , CAPEC-78 (opens in a new tab) , CAPEC-79 (opens in a new tab) , CAPEC-8 (opens in a new tab) , CAPEC-80 (opens in a new tab) , CAPEC-85 (opens in a new tab) , CAPEC-88 (opens in a new tab) , CAPEC-9 (opens in a new tab) , CAPEC-92 (opens in a new tab)
Vendor: servicenow
Vulnerable product: servicenow
CVE published: 2024-07-10
CVE last modified: 2026-06-17
Affected versions (NVD configurations):
- servicenow: utah
- servicenow: utah early_availability
- servicenow: utah patch_1
- servicenow: utah patch_1_hotfix_1
- servicenow: utah patch_1_hotfix_1a
- servicenow: utah patch_1_hotfix_1b
- servicenow: utah patch_1_hotfix_2
- servicenow: utah patch_10
- servicenow: utah patch_10_hotfix_1
- servicenow: utah patch_10_hotfix_2
- servicenow: utah patch_10a
- servicenow: utah patch_10a_hotfix_1
- servicenow: utah patch_10b
- servicenow: utah patch_2
- servicenow: utah patch_2_hotfix_1
- servicenow: utah patch_2_hotfix_2
- servicenow: utah patch_2_hotfix_3
- servicenow: utah patch_2_hotfix_4
- servicenow: utah patch_3
- servicenow: utah patch_3_hotfix_1
- servicenow: utah patch_3_hotfix_1b
- servicenow: utah patch_4
- servicenow: utah patch_4_hotfix_1
- servicenow: utah patch_4_hotfix_2
- servicenow: utah patch_4_hotfix_2a
- servicenow: utah patch_4_hotfix_2b
- servicenow: utah patch_4_hotfix_3
- servicenow: utah patch_4_hotfix_3b
- servicenow: utah patch_4_hotfix_4
- servicenow: utah patch_4_hotfix_4b
- servicenow: utah patch_4_hotfix_5
- servicenow: utah patch_5
- servicenow: utah patch_5_hotfix_1
- servicenow: utah patch_6
- servicenow: utah patch_6_hotfix_1
- servicenow: utah patch_6_hotfix_2
- servicenow: utah patch_7
- servicenow: utah patch_7_hotfix_1
- servicenow: utah patch_7_hotfix_2
- servicenow: utah patch_7a
- servicenow: utah patch_7b
- servicenow: utah patch_8
- servicenow: utah patch_8_hotfix_2
- servicenow: utah patch_9
- servicenow: utah patch_9_hotfix_1
- servicenow: utah patch_9_hotfix_1a
- servicenow: utah patch_9_hotfix_1b
- servicenow: vancouver
- servicenow: vancouver patch_1
- servicenow: vancouver patch_1_hotfix_1
- servicenow: vancouver patch_2
- servicenow: vancouver patch_2_hotfix_1
- servicenow: vancouver patch_2_hotfix_1a
- servicenow: vancouver patch_2_hotfix_2
- servicenow: vancouver patch_2_hotfix_3
- servicenow: vancouver patch_2_hotfix1a
- servicenow: vancouver patch_3
- servicenow: vancouver patch_3_hotfix_1
- servicenow: vancouver patch_3_hotfix_2
- servicenow: vancouver patch_3_hotfix_3
- servicenow: vancouver patch_3_hotfix_4
- servicenow: vancouver patch_4
- servicenow: vancouver patch_4_hotfix_1
- servicenow: vancouver patch_4_hotfix_1a
- servicenow: vancouver patch_4_hotfix_1b
- servicenow: vancouver patch_4_hotfix_2b
- servicenow: vancouver patch_5
- servicenow: vancouver patch_5_hotfix_1
- servicenow: vancouver patch_6
- servicenow: vancouver patch_6_hotfix_1
- servicenow: vancouver patch_7
- servicenow: vancouver patch_7_hotfix_1
- servicenow: vancouver patch_7_hotfix_1a
- servicenow: vancouver patch_7_hotfix_2
- servicenow: vancouver patch_7_hotfix_2a
- servicenow: vancouver patch_7_hotfix_2b
- servicenow: vancouver patch_7_hotfix_3a
- servicenow: vancouver patch_7_hotfix_4
- servicenow: vancouver patch_7_hotifix_1a
- servicenow: vancouver patch_7_hotifix_1b
- servicenow: vancouver patch_7_hotifix_2a
- servicenow: vancouver patch_7_hotifix_2b
- servicenow: vancouver patch_8
- servicenow: vancouver patch_8_hotfix_1
- servicenow: vancouver patch_8_hotfix_2
- servicenow: vancouver patch_8_hotfix_3
- servicenow: vancouver patch_9
- servicenow: washington_dc
- servicenow: washington_dc patch_1
- servicenow: washington_dc patch_1_hotfix_1
- servicenow: washington_dc patch_1_hotfix_2
- servicenow: washington_dc patch_1_hotfix_2a
- servicenow: washington_dc patch_1_hotfix_2b
- servicenow: washington_dc patch_2
- servicenow: washington_dc patch_2_hotfix_1
- servicenow: washington_dc patch_3
- servicenow: washington_dc patch_3_hotfix_1
- servicenow: washington_dc patch_4
- servicenow: washington_dc patch_5
EPSS: 0.9963; 99.9th percentile (FIRST (opens in a new tab) )
CISA KEV: Listed (added 2024-07-29)
- Known ransomware campaign use: Unknown
Latest Update: 2026-09-06
Selected Rule IDs observed: 340157 , 340159 , 342259 , 344370 , 360147 , 360148 , 380026
Matching rules: 7; rules with blocking actions: 7
Would-block Rule IDs: 340157 , 340159 , 342259 , 344370 , 360147 , 360148 , 380026
Request surfaces inspected: JSON request data, Request URI, Request argument names, Request arguments, Request cookies, Request filename, Request headers, SOAP request data, XML request data

Technical CPE data

This section lists vulnerable CPE matches retained from the NVD configurations. It supplements the readable affected-product information above.

cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*
- NVD match criteria ID: 69E0078E-1953-4F4F-9D5A-B1A140C4B310
cpe:2.3:a:servicenow:servicenow:utah:early_availability:*:*:*:*:*:*
- NVD match criteria ID: 03FE0B52-C7A6-4632-A09E-BE7AB8610DD7
cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:*
- NVD match criteria ID: DB5CA109-5DC1-4952-AC15-69FAC332BCA2
cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 44506775-0370-4583-9236-6C9F646B6622
cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1a:*:*:*:*:*:*
- NVD match criteria ID: 1A76B918-45DB-49A9-B323-5CB6FF8200AA
cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1b:*:*:*:*:*:*
- NVD match criteria ID: 118B4618-8702-4C38-88EE-B41C2C9DBF31
cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_2:*:*:*:*:*:*
- NVD match criteria ID: 92BED123-0FFC-4113-B0B6-A1A8BD69F4CF
cpe:2.3:a:servicenow:servicenow:utah:patch_10:*:*:*:*:*:*
- NVD match criteria ID: 76439FC6-2DD2-4AD4-9EB6-A2FEAC10B205
cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 8097D9B0-9329-4EB7-BB7E-0FF3057D408B
cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_2:*:*:*:*:*:*
- NVD match criteria ID: AFEA8D14-D1C8-486B-ABE7-25C9D6B72CE9
cpe:2.3:a:servicenow:servicenow:utah:patch_10a:*:*:*:*:*:*
- NVD match criteria ID: 5DA716A2-E697-4BC3-8127-E772E67E1C49
cpe:2.3:a:servicenow:servicenow:utah:patch_10a_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: EEBB1DCE-25AA-4F95-984C-5BB5341A90ED
cpe:2.3:a:servicenow:servicenow:utah:patch_10b:*:*:*:*:*:*
- NVD match criteria ID: AE34BA83-3810-4314-9A45-B1A8944C6612
cpe:2.3:a:servicenow:servicenow:utah:patch_2:*:*:*:*:*:*
- NVD match criteria ID: 98E3E0AF-A341-43BB-91C6-75BBDE695280
cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 20AC3991-0E5B-4164-807F-0E270B1867BE
cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_2:*:*:*:*:*:*
- NVD match criteria ID: 44F86BEB-77D0-41AF-816C-F73B2D9601FE
cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_3:*:*:*:*:*:*
- NVD match criteria ID: C9C467AA-B1A2-4A2A-8363-623232BCBCA0
cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_4:*:*:*:*:*:*
- NVD match criteria ID: A6E189F6-6623-4A0C-8767-A3CC1C12B759
cpe:2.3:a:servicenow:servicenow:utah:patch_3:*:*:*:*:*:*
- NVD match criteria ID: 9D6885DD-230B-468B-B936-7512BE80849D
cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 1476C240-FCB0-43E3-9C79-2264DB6C200A
cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1b:*:*:*:*:*:*
- NVD match criteria ID: 9783CA53-CDBD-44F0-B2B9-8C49EBE9FCB4
cpe:2.3:a:servicenow:servicenow:utah:patch_4:*:*:*:*:*:*
- NVD match criteria ID: 481EC1AA-5863-4641-B67F-CD51416ED0EA
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 402D816A-2650-4743-A386-029C0D063C39
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2:*:*:*:*:*:*
- NVD match criteria ID: 56CBE65E-2D5A-4191-A2F4-8AC76050404F
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2a:*:*:*:*:*:*
- NVD match criteria ID: 05587BC2-574F-42B6-A121-7ACFD0691ED5
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2b:*:*:*:*:*:*
- NVD match criteria ID: 76D69B8D-02EE-4E3D-9F54-E94F6DB09D5B
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3:*:*:*:*:*:*
- NVD match criteria ID: CC772DD6-2814-4EEF-A524-CC752C277337
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3b:*:*:*:*:*:*
- NVD match criteria ID: 996C57B4-E8AC-48F6-BA71-328F714B1BAC
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4:*:*:*:*:*:*
- NVD match criteria ID: 10B82BE2-BE38-4EA7-85D5-AC28FF4F50BD
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4b:*:*:*:*:*:*
- NVD match criteria ID: D66B18D1-486D-4390-9D1E-5348D1C6729A
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_5:*:*:*:*:*:*
- NVD match criteria ID: A0EC8ACE-70CA-44FC-ACA7-0868D620C86D
cpe:2.3:a:servicenow:servicenow:utah:patch_5:*:*:*:*:*:*
- NVD match criteria ID: 8D934721-565F-4707-A32A-B7E4BB9D2DD0
cpe:2.3:a:servicenow:servicenow:utah:patch_5_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 4AA97D74-290C-47C7-9976-6EF83950C530
cpe:2.3:a:servicenow:servicenow:utah:patch_6:*:*:*:*:*:*
- NVD match criteria ID: 122E0C17-B29B-44B9-A37E-745B103AD398
cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: AADFD5CE-9C9D-46FF-9871-E2BD7B2C8B98
cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_2:*:*:*:*:*:*
- NVD match criteria ID: ECE96EED-C729-4A84-B437-79CCE029C391
cpe:2.3:a:servicenow:servicenow:utah:patch_7:*:*:*:*:*:*
- NVD match criteria ID: 8BD49264-D243-4625-828C-AF383D826779
cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: FB29FCEC-3DDB-46EE-A7AA-4728E6B9A1D6
cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_2:*:*:*:*:*:*
- NVD match criteria ID: AC4CA2B8-EFD8-4C01-8F9C-E613619062DF
cpe:2.3:a:servicenow:servicenow:utah:patch_7a:*:*:*:*:*:*
- NVD match criteria ID: 0F601F74-593A-4566-A763-EF05E5138FA7
cpe:2.3:a:servicenow:servicenow:utah:patch_7b:*:*:*:*:*:*
- NVD match criteria ID: 47D4CC0E-E3F5-49AB-9D92-AC8FFB17A4C0
cpe:2.3:a:servicenow:servicenow:utah:patch_8:*:*:*:*:*:*
- NVD match criteria ID: 8A4CD267-D72A-4F09-BE9B-F008B1804AD9
cpe:2.3:a:servicenow:servicenow:utah:patch_8_hotfix_2:*:*:*:*:*:*
- NVD match criteria ID: 24D2EBC6-F894-4C1D-A2FF-B49FF4007ED8
cpe:2.3:a:servicenow:servicenow:utah:patch_9:*:*:*:*:*:*
- NVD match criteria ID: 26D23EE3-0F88-47F7-ADCD-B74F81A08D9B
cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: FB793686-954A-49F8-BC35-A95325D61303
cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1a:*:*:*:*:*:*
- NVD match criteria ID: 38DDACA8-69A9-4047-AD99-A7DDC320EAD8
cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1b:*:*:*:*:*:*
- NVD match criteria ID: 926C0F6A-0599-4239-B1CE-5D864BBAA315
cpe:2.3:a:servicenow:servicenow:vancouver:-:*:*:*:*:*:*
- NVD match criteria ID: 9DB67FCA-6127-486F-A866-3D5E63B81C35
cpe:2.3:a:servicenow:servicenow:vancouver:patch_1:*:*:*:*:*:*
- NVD match criteria ID: 9132AB29-33C1-4825-BAD4-2804C26316B1
cpe:2.3:a:servicenow:servicenow:vancouver:patch_1_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 68D99613-53A1-4B09-9A78-F8EFA0CC6B01
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2:*:*:*:*:*:*
- NVD match criteria ID: E8FCCFB6-DB7E-4DED-A7E0-1C03087754F5
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 7ED2051C-FE4F-4C0A-A3BF-E33141DC3250
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1a:*:*:*:*:*:*
- NVD match criteria ID: 8CFD4017-5B8E-4CAF-B9E5-4A675C11F01A
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_2:*:*:*:*:*:*
- NVD match criteria ID: 40D69E69-DF88-4F8C-A9BD-B642829107E4
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_3:*:*:*:*:*:*
- NVD match criteria ID: 4D21A542-15DC-432C-9C60-F7CABE8D4807
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix1a:*:*:*:*:*:*
- NVD match criteria ID: 1596163B-637A-49F9-B01F-C6CC297F7E5B
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3:*:*:*:*:*:*
- NVD match criteria ID: 0B915FDA-9DCB-43B5-8081-F0690996A3EF
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 7308FA07-5C6D-41AA-9EE1-EE9BAAB50A1B
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_2:*:*:*:*:*:*
- NVD match criteria ID: 5ED407E7-9595-4B4D-9D53-1A4807BA327C
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_3:*:*:*:*:*:*
- NVD match criteria ID: 1EA5B288-54DB-437E-88C2-05F90FF3C918
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_4:*:*:*:*:*:*
- NVD match criteria ID: 6ED497ED-1588-4CF8-AE83-7CC7BEF8B982
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4:*:*:*:*:*:*
- NVD match criteria ID: A74A3197-68F7-4303-A731-B87A8BF3F831
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: A08FD0FD-E062-4BEC-BE95-0ED2D106826B
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1a:*:*:*:*:*:*
- NVD match criteria ID: 5F6A6F12-4D7A-4FD3-8FD6-C32D797BB810
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1b:*:*:*:*:*:*
- NVD match criteria ID: 847F9124-F3C6-4C93-9E80-544CB0580C8C
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_2b:*:*:*:*:*:*
- NVD match criteria ID: 12808B52-8F7D-4EE0-A43E-85A1C70A6BE3
cpe:2.3:a:servicenow:servicenow:vancouver:patch_5:*:*:*:*:*:*
- NVD match criteria ID: 81880B84-5E9D-4B7F-B1D5-1BF8D25DAF5D
cpe:2.3:a:servicenow:servicenow:vancouver:patch_5_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 8011D2A7-770B-4AE5-80E6-C762F4F0BB55
cpe:2.3:a:servicenow:servicenow:vancouver:patch_6:*:*:*:*:*:*
- NVD match criteria ID: A58603E3-5AFC-4606-8F9E-1B4FF9A9B843
cpe:2.3:a:servicenow:servicenow:vancouver:patch_6_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: BED5F42A-5FFF-43E0-9BAD-A5E6C1110551
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7:*:*:*:*:*:*
- NVD match criteria ID: ABE64339-EF0B-4430-9768-FA7DE82AA61F
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: FF79CA67-765A-4CCB-B1CB-EE1FC02CFCFA
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1a:*:*:*:*:*:*
- NVD match criteria ID: A3E71353-9AFF-4B6D-89BC-A2909A7C5DDF
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2:*:*:*:*:*:*
- NVD match criteria ID: C9C5B57E-7852-4E38-9BDA-864CF6F9DB5A
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2a:*:*:*:*:*:*
- NVD match criteria ID: EAA2E502-FCBC-404D-8FFA-4601F1D5B747
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2b:*:*:*:*:*:*
- NVD match criteria ID: 650956A6-8DE6-4C16-A77C-2B208B41DF5F
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_3a:*:*:*:*:*:*
- NVD match criteria ID: A49AC0E0-9164-43AD-959A-55FCB7965858
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_4:*:*:*:*:*:*
- NVD match criteria ID: 46277115-1A2B-4526-83E8-1446EB5A1EAB
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1a:*:*:*:*:*:*
- NVD match criteria ID: 6CDFB167-F252-46A6-A5F6-EF9A4F93FC03
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1b:*:*:*:*:*:*
- NVD match criteria ID: 43DE243B-E90A-4857-A3A6-3A045FE2D75F
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2a:*:*:*:*:*:*
- NVD match criteria ID: 33689F99-48DD-47C6-AFAC-DC5D10785860
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2b:*:*:*:*:*:*
- NVD match criteria ID: 8F664F1F-5FB2-48B1-93C7-5DF415E673B7
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8:*:*:*:*:*:*
- NVD match criteria ID: C641B881-7379-448A-A785-3381C72F8353
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 03D48963-936B-4A48-8859-A5066A259E03
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_2:*:*:*:*:*:*
- NVD match criteria ID: 9149B850-7196-476A-9A27-DEB85B8C6F19
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_3:*:*:*:*:*:*
- NVD match criteria ID: 10622260-FCBC-4CC0-804E-55D75200FC46
cpe:2.3:a:servicenow:servicenow:vancouver:patch_9:*:*:*:*:*:*
- NVD match criteria ID: CF44F7A1-D153-4723-BA45-0FE4E4725C2F
cpe:2.3:a:servicenow:servicenow:washington_dc:-:*:*:*:*:*:*
- NVD match criteria ID: FFAC3BF9-2443-4C43-B67A-2BB99297D295
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1:*:*:*:*:*:*
- NVD match criteria ID: 444DD275-789F-4C07-9D98-BBFAA1640DB3
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 5B29B708-BD7C-4A6C-9E78-37D045101A17
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2:*:*:*:*:*:*
- NVD match criteria ID: 1F6EDFA3-9014-4AA7-A17F-DDB1FE96588E
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2a:*:*:*:*:*:*
- NVD match criteria ID: 1DA447CA-A6A2-436C-9909-3F0419B7DD6F
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2b:*:*:*:*:*:*
- NVD match criteria ID: 9F263893-6D34-49D6-9407-ED6CB823595E
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2:*:*:*:*:*:*
- NVD match criteria ID: D18E2CD1-AC8E-4ABF-88DE-D3E61A297ED1
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: 52FC3724-35E5-4C3A-B6BA-3B270EA4255E
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3:*:*:*:*:*:*
- NVD match criteria ID: 6137BB81-6B48-4DCB-A9F6-A27D869C12FC
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3_hotfix_1:*:*:*:*:*:*
- NVD match criteria ID: B06EABB5-0327-4816-AC7B-34D021758812
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4:*:*:*:*:*:*
- NVD match criteria ID: 29DC5FC9-2ACF-4C51-93C4-2D0982BA0CA6
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5:*:*:*:*:*:*
- NVD match criteria ID: 9CD5A918-9B71-4CFD-A6DB-437D3B647C6A

Vulnerability Description

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Recommended Actions

Maintain the observed Atomicorp protections. Keep your Atomicorp commercial rules current and confirm that the selected observed rules (340157 , 340159 , 342259 , 344370 , 360147 , 360148 , 380026 ) have not been locally disabled. Atomicorp commercial rules are enabled by default. If you use Atomic WAF, review the applicable policy and rule settings.
Apply the vendor’s remediation. WAF protection is defense in depth and does not replace upgrading or following the affected vendor’s guidance.
- Affected versions: ServiceNow Now Platform versions earlier than Utah Patch 10 Hot Fix 3.
- Affected versions: ServiceNow Now Platform versions earlier than Utah Patch 10a Hot Fix 2.
- Affected versions: ServiceNow Now Platform versions earlier than Utah Patch 10b Hot Fix 1.
- Affected versions: ServiceNow Now Platform versions earlier than Vancouver Patch 6 Hot Fix 2.
- Affected versions: ServiceNow Now Platform versions earlier than Vancouver Patch 7 Hot Fix 3b.
- Affected versions: ServiceNow Now Platform versions earlier than Vancouver Patch 8 Hot Fix 4.
- Affected versions: ServiceNow Now Platform versions earlier than Vancouver Patch 9 Hot Fix 1.
- Affected versions: ServiceNow Now Platform versions earlier than Vancouver Patch 10.
- Affected versions: ServiceNow Now Platform versions earlier than Washington DC Patch 1 Hot Fix 3b.
- Affected versions: ServiceNow Now Platform versions earlier than Washington DC Patch 2 Hot Fix 2.
- Affected versions: ServiceNow Now Platform versions earlier than Washington DC Patch 3 Hot Fix 2.
- Affected versions: ServiceNow Now Platform versions earlier than Washington DC Patch 4.
- Affected versions: ServiceNow Now Platform versions earlier than Washington DC Patch 5.
- No specific CNA/vendor solution or workaround is included in the current CVE Record (opens in a new tab) . Review the vendor’s security advisories and supported-release guidance before making changes.
- CISA KEV required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA KEV federal remediation due date: 2024-08-19
Validate after changes. Confirm rule updates are current, review WAF events for the affected application, and test application behavior after vendor upgrades, mitigations, or local policy changes.

Research Notes

Atomicorp WAF protections are designed around attack techniques and exploit behaviors, allowing existing protections to apply across multiple vulnerabilities without requiring a unique rule for every CVE.

Public Vulnerability References

NVD (opens in a new tab)
CVE Record (opens in a new tab)
CVE authority reference: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293 (opens in a new tab)
Vendor advisory: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313 (opens in a new tab)
CVE authority reference: https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit (opens in a new tab)
CVE authority reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5217 (opens in a new tab)

MITRE ATT&CK Context

The following mappings are published by the MITRE Center for Threat-Informed Defense and describe exploitation behavior or potential impact; they do not claim that a WAF rule implements the ATT&CK technique.

Exploitation Technique: T1059 — Command and Scripting Interpreter (opens in a new tab)

Test or Research Source

Source: http/cves/2024/CVE-2024-5217.yaml (opens in a new tab)
Tags: cve, cve2024, kev, rce, servicenow, vkev, vuln

Research Note Context

This research note documents exploit-technique analysis associated with this vulnerability and references Atomicorp WAF protections observed during engineering review, testing, or validation activities.

Atomicorp security controls are generally designed to identify and mitigate attack techniques and exploit behaviors rather than individual CVE identifiers. As a result, protections developed for one vulnerability may also apply to related attack variants and future vulnerabilities using similar techniques.

Learn More

Atomicorp develops commercially supported security technologies for web applications, servers, endpoints, workloads, and legacy enterprise platforms.

Organizations interested in protecting systems against exploit techniques associated with vulnerabilities such as this one can learn more about:

Atomic ModSecurity Rules: commercially maintained WAF rules for ModSecurity deployments, including protections for web attacks, bots, scanners, malware, exploitation attempts, and emerging vulnerability classes.
Atomic WAF: an enterprise web application firewall with Atomicorp rules, centralized management, reporting, authentication controls, and operational tooling.
Atomic ModSecurity Integrator: a special licensing option for MSPs, MSSPs, OEMs, VARs, reverse proxy providers, and other integrators who want to incorporate Atomicorp ModSecurity rule technology into their own products or services.
Atomic OSSEC: an enterprise OSSEC-based intrusion detection, compliance, and security monitoring platform.
Atomic Protector: workload protection for Linux, web, cloud, data center, and hybrid environments.

For additional information, product evaluations, or technical discussions, visit https://www.atomicorp.com/ or https://modsecurity.io/ (opens in a new tab) .