CVE-2024-8924 - Unauthenticated Blind SQL Injection in Core Platform - Security

CVE-2024-8924 - Unauthenticated Blind SQL Injection in Core Platform  ServiceNow Posture October, 2024 Description ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Xanadu, Washington DC, and earlier Now Platform releases. This vulnerability could potentially enable an unauthenticated user to acquire unauthorized data stored within the Now Platform. Resolution During the October 2024 Patching Program, ServiceNow released patches (listed below) to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Release Fixed Version Xanadu

Xanadu Patch 1

Washington DC

Washington DC Patch 4 Hot Fix 2b

Washington DC Patch 6 Hot Fix 1

Washington DC Patch 7

Vancouver

Vancouver Patch 9 Hot Fix 3b

Vancouver Patch 10 Hot Fix 2

Additional Resources https://www.cve.org/CVERecord?id=CVE-2024-8924 KB1703444 (NowSupport Login Required) Change Log Version Published Summary of Changes 1.0 October 29, 2024 Initial publication