CVE-2024-5217Incomplete Input Validation in GlideExpression Script

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

9.2 CRITICALEPSS 99.62%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 08:15 UTC

OverviewCVSS details

9.2CRITICALCVSS 4.0

Score source: SN (CNA)
NVD status: Analyzed
Published: Jul 10, 2024
Assigner: SN

Affected

Now Platform (ServiceNow)

Versions: before Utah Patch 10 Hot Fix 3 · before Utah Patch 10a Hot Fix 2
Fixed in: Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2, Utah Patch 10b Hot Fix 1

All affected versions →

Exploitation

Public exploit: None listed
CISA KEV: Listed · Jul 29, 2024
KEV due date: Aug 19, 2024
Ransomware use: Unknown
SSVC: Exploitation active · Automatable yes · Impact total

EPSS · FIRST, scored Nov 8

99.62%chance of exploitation in 30 days

Higher than 99.94% of CVEs

CVSS 4.0 · SN (CNA)

9.2Critical

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · SN (CNA)

9.8Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.2	CRITICAL	4.0SN (CNA)	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
9.8	CRITICAL	3.1SN (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Aug 19, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2024-5217
Status: Analyzed
Assigner (CNA): SN
Published: Jul 10, 2024
Last modified: 2026-06-17 08:15 UTC
Weaknesses: CWE-184 · Incomplete List of Disallowed Inputs
CWE-697

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 14:13 UTC.