Research · Jul 10, 2024 · ZeroDay Catalog
ServiceNow Addresses Critical Input Validation Vulnerability
ServiceNow has resolved a significant input validation vulnerability that could allow remote code execution, affecting multiple releases of the Now Platform.
What changed
ServiceNow has patched an input validation vulnerability that was discovered in the Vancouver and Washington DC releases of the Now Platform. This flaw could potentially allow an unauthenticated user to execute arbitrary code remotely, posing a serious security risk.
The company has proactively released updates to hosted instances and made the patches available to partners and self-hosted customers to mitigate this vulnerability.
- Vulnerability allows remote code execution.
- Affected releases include Vancouver and Washington DC.
- Patches have been applied to hosted instances.
Who is affected
Organizations utilizing the Now Platform from ServiceNow should be aware of this vulnerability, as it affects multiple deployment scenarios.
Both self-hosted customers and those using ServiceNow's cloud-hosted solutions need to ensure they are up to date with the latest security patches.
- ServiceNow Now Platform users.
- Self-hosted customers of ServiceNow.
- Partners utilizing ServiceNow services.
What to do
It is crucial for affected organizations to apply the relevant security patches immediately to safeguard their systems against potential exploitation.
Review your instance's update status and ensure that all necessary hot fixes are implemented without delay.
- Apply security patches relevant to your instance.
- Verify the update status of your Now Platform deployment.
- Monitor for any further communications from ServiceNow regarding this vulnerability.