CVE-2024-8923 - Sandbox Escape in Now Platform - Security

CVE-2024-8923 - Sandbox Escape in Now Platform  ServiceNow Posture October, 2024 Description ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform releases prior to Xanadu General Availability. This vulnerability could potentially enable an unauthenticated user to remotely execute code within the context of the Now Platform. Resolution During the August 2024 Patching Program, ServiceNow released patches (listed below) to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Release Fixed Version Xanadu

Xanadu GA Release

Washington DC

Washington DC Patch 4 Hot Fix 1a

Washington DC Patch 5

Vancouver

Vancouver Patch 9 Hot Fix 2a

Vancouver Patch 10

Additional Resources

For more details, please see the following resources:

https://www.cve.org/CVERecord?id=CVE-2024-8923 KB1703444 (NowSupport Login Required) Change Log Version Published Summary of Changes 1.0 October 29, 2024 Initial publication