{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-5890", "assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375", "state": "PUBLISHED", "assignerShortName": "SN", "dateReserved": "2024-06-12T00:02:00.934Z", "datePublished": "2024-12-02T18:24:55.797Z", "dateUpdated": "2024-12-02T19:21:08.073Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Now Platform", "vendor": "ServiceNow", "versions": [{"lessThan": "Utah Patch 8 Hot Fix 1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Vancouver Patch 10", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Vancouver Patch 9", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Washington DC Early Access", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Alexandre Rodrigo Da Silva"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">ServiceNow has addressed an HTML injection vulnerability that was </span><span style=\"background-color: rgb(255, 255, 255);\">identified</span><span style=\"background-color: rgb(255, 255, 255);\"> in the Now Platform. This vulnerability could</span><span style=\"background-color: rgb(255, 255, 255);\"> potentially</span><span style=\"background-color: rgb(255, 255, 255);\"> enable an unauthenticated user to </span><span style=\"background-color: rgb(255, 255, 255);\">modify</span> <span style=\"background-color: rgb(255, 255, 255);\">a</span> <span style=\"background-color: rgb(255, 255, 255);\">web </span><span style=\"background-color: rgb(255, 255, 255);\">page</span><span style=\"background-color: rgb(255, 255, 255);\"> or redirect users to another </span><span style=\"background-color: rgb(255, 255, 255);\">website</span><span style=\"background-color: rgb(255, 255, 255);\">.<br><br><span style=\"background-color: rgb(255, 255, 255);\">ServiceNow </span><span style=\"background-color: rgb(255, 255, 255);\">released</span> <span style=\"background-color: rgb(255, 255, 255);\">update</span><span style=\"background-color: rgb(255, 255, 255);\">s</span><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;to customers</span><span style=\"background-color: rgb(255, 255, 255);\"> that addressed this vulnerability</span><span style=\"background-color: rgb(255, 255, 255);\">. </span><span style=\"background-color: rgb(255, 255, 255);\">If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible</span><span style=\"background-color: rgb(255, 255, 255);\">.</span></span><br>"}], "value": "ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.\n\nServiceNow released updates\u00a0to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375", "shortName": "SN", "dateUpdated": "2024-12-02T18:24:55.797Z"}, "references": [{"url": "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1710511"}], "source": {"discovery": "UNKNOWN"}, "title": "HTML Injection in the Assessment plugin", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5890", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-02T19:20:40.477397Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-02T19:21:08.073Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5890", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-02T19:20:40.477397Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-02T19:20:42.779Z"}}], "cna": {"title": "HTML Injection in the Assessment plugin", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Alexandre Rodrigo Da Silva"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ServiceNow", "product": "Now Platform", "versions": [{"status": "affected", "version": "0", "lessThan": "Utah Patch 8 Hot Fix 1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "Vancouver Patch 10", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "Vancouver Patch 9", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "Washington DC Early Access", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1710511"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.\n\nServiceNow released updates\u00a0to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">ServiceNow has addressed an HTML injection vulnerability that was </span><span style=\"background-color: rgb(255, 255, 255);\">identified</span><span style=\"background-color: rgb(255, 255, 255);\"> in the Now Platform. This vulnerability could</span><span style=\"background-color: rgb(255, 255, 255);\"> potentially</span><span style=\"background-color: rgb(255, 255, 255);\"> enable an unauthenticated user to </span><span style=\"background-color: rgb(255, 255, 255);\">modify</span> <span style=\"background-color: rgb(255, 255, 255);\">a</span> <span style=\"background-color: rgb(255, 255, 255);\">web </span><span style=\"background-color: rgb(255, 255, 255);\">page</span><span style=\"background-color: rgb(255, 255, 255);\"> or redirect users to another </span><span style=\"background-color: rgb(255, 255, 255);\">website</span><span style=\"background-color: rgb(255, 255, 255);\">.<br><br><span style=\"background-color: rgb(255, 255, 255);\">ServiceNow </span><span style=\"background-color: rgb(255, 255, 255);\">released</span> <span style=\"background-color: rgb(255, 255, 255);\">update</span><span style=\"background-color: rgb(255, 255, 255);\">s</span><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;to customers</span><span style=\"background-color: rgb(255, 255, 255);\"> that addressed this vulnerability</span><span style=\"background-color: rgb(255, 255, 255);\">. </span><span style=\"background-color: rgb(255, 255, 255);\">If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible</span><span style=\"background-color: rgb(255, 255, 255);\">.</span></span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375", "shortName": "SN", "dateUpdated": "2024-12-02T18:24:55.797Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5890", "state": "PUBLISHED", "dateUpdated": "2024-12-02T19:21:08.073Z", "dateReserved": "2024-06-12T00:02:00.934Z", "assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375", "datePublished": "2024-12-02T18:24:55.797Z", "assignerShortName": "SN"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.\n\nServiceNow released updates\u00a0to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible."}, {"lang": "es", "value": " ServiceNow ha solucionado una vulnerabilidad de inyecci\u00f3n de HTML que se identific\u00f3 en la Plataforma Now. Esta vulnerabilidad podr\u00eda permitir que un usuario no autenticado modifique una p\u00e1gina web o redirija a los usuarios a otro sitio web. ServiceNow public\u00f3 actualizaciones para los clientes que solucionaron esta vulnerabilidad. Si a\u00fan no lo ha hecho, le recomendamos que aplique los parches de seguridad pertinentes a sus instancias lo antes posible."}], "id": "CVE-2024-5890", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "psirt@servicenow.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@servicenow.com", "type": "Secondary"}]}, "published": "2024-12-02T19:15:12.357", "references": [{"source": "psirt@servicenow.com", "url": "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1710511"}], "sourceIdentifier": "psirt@servicenow.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@servicenow.com", "type": "Secondary"}]}

{}