{"cveID":"CVE-2024-5217","vendorProject":"ServiceNow","product":"Utah, Vancouver, and Washington DC Now Platform","vulnerabilityName":"ServiceNow Incomplete List of Disallowed Inputs Vulnerability","dateAdded":"2024-07-29","shortDescription":"ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","dueDate":"2024-08-19","knownRansomwareCampaignUse":"Unknown","notes":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313; https://nvd.nist.gov/vuln/detail/CVE-2024-5217","cwes":["CWE-184"],"year":2024,"state":"mapped","stale_reasons":[],"mappings":[{"domain":"enterprise","cve":"CVE-2024-5217","technique":"T1059","technique_name_at_mapping":"Command and Scripting Interpreter","mapping_type":"exploitation_technique","capability_group":"input_validation","comments":"CVE-2024-5217 is an input validation vulnerability that could enable an unauthenticated user to remotely execute code within the context of the ServiceNow Platform due to incomplete input validation in a GlideExpression Script. Organizations often use the ServiceNow platform to host sensitive data about their employees, including their personally identifiable information and HR records related to their employment.","references":["https://arcticwolf.com/resources/blog/cve-2024-4879-cve-2024-5178-cve-2024-5217/","https://techcrunch.com/2025/03/20/hackers-are-ramping-up-attacks-using-year-old-servicenow-security-bugs-to-break-into-unpatched-systems/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2024-5217","technique":"T1005","technique_name_at_mapping":"Data from Local System","mapping_type":"primary_impact","capability_group":"input_validation","comments":"CVE-2024-5217 is an input validation vulnerability that could enable an unauthenticated user to remotely execute code within the context of the ServiceNow Platform due to incomplete input validation in a GlideExpression Script. Organizations often use the ServiceNow platform to host sensitive data about their employees, including their personally identifiable information and HR records related to their employment.","references":["https://arcticwolf.com/resources/blog/cve-2024-4879-cve-2024-5178-cve-2024-5217/","https://techcrunch.com/2025/03/20/hackers-are-ramping-up-attacks-using-year-old-servicenow-security-bugs-to-break-into-unpatched-systems/"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"}],"techniques":[{"id":"T1005","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Data from Local System","name_at_mapping":"Data from Local System","renamed":false,"revoked_by":null,"mapping_types":["primary_impact"],"sigma_rule_count":14,"has_detection_strategy":true},{"id":"T1059","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Command and Scripting Interpreter","name_at_mapping":"Command and Scripting Interpreter","renamed":false,"revoked_by":null,"mapping_types":["exploitation_technique"],"sigma_rule_count":95,"has_detection_strategy":true}],"mapping_types":["exploitation_technique","primary_impact"],"has_exploitation_technique":true,"mapping_attack_versions":["16.1"],"mapping_domains":["enterprise"],"sigma_coverage":"full","sigma_rules_tagged_cve":[],"added_after_mapping_snapshot":false,"_source":"kevmap","_built":"2026-08-23 05:47 UTC","_attack_version":"19.2"}