CVE-2024-5178 – Incomplete Input Validation in SecurelyAccess API - Security

CVE-2024-5178 – Incomplete Input Validation in SecurelyAccess API

ServiceNow Posture July, 2024 Description ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerability could allow an administrative user to gain unauthorized access to sensitive files on the web application server. Resolution The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible. Release Fixed Version Utah Utah Patch 10 Hot Fix 3 Utah Patch 10a Hot Fix 2 Utah Patch 10b Hot Fix 1 Vancouver Vancouver Patch 6 Hot Fix 2 Vancouver Patch 7 Hot Fix 3b Vancouver Patch 8 Hot Fix 4 Vancouver Patch 9 Hot Fix 1 Vancouver Patch 10 Washington Washington DC Patch 1 Hot Fix 3b Washington DC Patch 2 Hot Fix 2 Washington DC Patch 3 Hot Fix 2 Washington DC Patch 4 Additional Resources For more details, please see the following resources: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5178 UI Page Template Maintenance – KB1644293 (NowSupport Login Required) Change Log Version Published Summary of Changes 2.0 July 10, 2024 CVE publication