CVE-2024-5217 - CVE House
Back to Database
Status published Critical CVE-2024-5217

Incomplete Input Validation in GlideExpression Script

Vulnerability Description

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-5217

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Adam Kues
  • Assetnote Attack Surface Management

References

More from ServiceNow

View All →
CVE-2025-3648
Data Inference in Now Platform via Conditional ACLs
High 8.2
CVE-2025-3089
Broken Access Control in ServiceNow AI Platform
Medium 5.3
CVE-2025-12420
Unauthenticated Privilege Escalation in ServiceNow AI Platform
Critical 9.3
CVE-2025-11450
Reflected Cross Site Scripting in ServiceNow AI Platform
Medium 5.3
CVE-2025-11449
Reflected Cross Site Scripting in ServiceNow AI Platform
Medium 5.3

Affected Vendor

Affected Software

Now Platform
Vulnerable Versions:
0

Timeline

Official Publish: July 10th, 2024
Last Modified: October 21st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-184

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.