CVE-2024-5178 - CVE House
Back to Database
Status published Medium CVE-2024-5178

Incomplete Input Validation in SecurelyAccess API

Vulnerability Description

ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerability could allow an administrative user to gain unauthorized access to sensitive files on the web application server. The vulnerability is addressed in the listed patches and hot fixes, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-5178

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Adam Kues
  • Assetnote Attack Surface Management

References

More from ServiceNow

View All →
CVE-2025-3648
Data Inference in Now Platform via Conditional ACLs
High 8.2
CVE-2025-3089
Broken Access Control in ServiceNow AI Platform
Medium 5.3
CVE-2025-12420
Unauthenticated Privilege Escalation in ServiceNow AI Platform
Critical 9.3
CVE-2025-11450
Reflected Cross Site Scripting in ServiceNow AI Platform
Medium 5.3
CVE-2025-11449
Reflected Cross Site Scripting in ServiceNow AI Platform
Medium 5.3

Affected Vendor

Affected Software

Now Platform
Vulnerable Versions:
0

Timeline

Official Publish: July 10th, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-184

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.