← Vulnerability feed

Vulnerability record · CVE-2024-8924 · published 29 October 2024

CVE-2024-8924: Servicenow sql injection vulnerability

Servicenow · Servicenow

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.

8.7 CVSS 4.0 High EPSS 0.50% · top 59.7% CWE-89 · SQL injection
8.7CVSS 4.0 base score
0.50%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1706072 Vendor Advisory

Track CVE-2024-8924 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2024-4879ServiceNow Now Platform input validation flaw allows unauthenticated RCEServiceNow's Now Platform (Vancouver and Washington DC releases) contains an input validation vulnerability that lets an unauthenticated remote attac…KEVEPSS 100%analysed9.2CVE-2024-5217ServiceNow Now Platform input validation flaw enables unauthenticated RCEServiceNow's Washington DC, Vancouver, and earlier Now Platform releases contain an input validation vulnerability (CWE-184 incomplete list of disall…KEVEPSS 100%analysed9.3CVE-2024-8923Servicenow code injection vulnerabilityServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticate…EPSS 1.1%8.8CVE-2018-7748Servicenow code injection vulnerabilityreport_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Inj…EPSS 2.6%6.5CVE-2022-43684Servicenow information exposure vulnerabilityServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality. Additional De…EPSS 1.8%6.1CVE-2023-1298Servicenow cross-site scripting vulnerabilityServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow …EPSS 0.39%6.1CVE-2022-46389Servicenow cross-site scripting vulnerabilityThere exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, S…EPSS 0.60%6.1CVE-2022-46886Servicenow open redirect vulnerabilityThere exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domai…EPSS 0.30%

Source: NIST National Vulnerability Database (record CVE-2024-8924), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.