ServiceNow Now Platform
11 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-3648 | Aspen | Data Inference in Now Platform via Conditional ACLs | HIGH 8.2 | 1.7 % | ||
| CVE-2025-0337 | < Washington DC Patch 9 ; < Xanadu Patch 4 ; < Yokohama | Authorization bypass in Now Platform | HIGH 7.1 | 0.4 % | ||
| CVE-2024-5890 | < Utah Patch 8 Hot Fix 1 ; < Vancouver Patch 10 ; < Vancouver Patch 9 ; … | HTML Injection in the Assessment plugin | MEDIUM 5.1 | 0.3 % | ||
| CVE-2024-8924 | < Utah Patch 10b Hot Fix 3 ; < Vancouver Patch 8 Hot Fix 5 ; < Vancouver Patch 9 Hot Fix 3b ; … | Unauthenticated Blind SQL Injection in Core Platform | HIGH 8.7 | 0.5 % | ||
| CVE-2024-8923 | < Vancouver Patch 9 Hot Fix 2a ; < Vancouver Patch 10 ; < Washington DC Patch 4 Hot Fix 1a ; … | Sandbox Escape in Now Platform | CRITICAL 9.3 | 1.1 % | ||
| CVE-2024-5217 | < Utah Patch 10 Hot Fix 3 ; < Utah Patch 10a Hot Fix 2 ; < Utah Patch 10b Hot Fix 1 ; … | Incomplete Input Validation in GlideExpression Script | CRITICAL 9.2 | 100 % | KEV | |
| CVE-2024-5178 | < Utah Patch 10 Hot Fix 3 ; < Utah Patch 10a Hot Fix 2 ; < Utah Patch 10b Hot Fix 1 ; … | Incomplete Input Validation in SecurelyAccess API | MEDIUM 6.9 | 34 % | ||
| CVE-2024-4879 | < Utah Patch 10 Hot Fix 3 ; < Utah Patch 10a Hot Fix 2 ; < Vancouver Patch 6 Hot Fix 2 ; … | Jelly Template Injection Vulnerability in ServiceNow UI Macros | CRITICAL 9.3 | 100 % | KEV | |
| CVE-2022-43684 | Quebec – < Patch 10 Hot Fix 8b ; Rome – < Patch 10 Hot Fix 1 ; San Diego – < Patch 7 ; … | ACL bypass in Reporting functionality | CRITICAL 9.9 | 1.8 % | ||
| CVE-2022-46389 | Quebec – < Patch 10 Hotfix 11b ; Rome – < Patch 10 Hotfix 3b ; San Diego – < Patch 9 ; … | Cross-Site Scripting (XSS) vulnerability found on logout functionality | MEDIUM 6.1 | 0.6 % | ||
| CVE-2022-39048 | Tokyo – < Patch 1a ; San Diego – < Patch 7b ; Rome – < Patch 10 Hotfix 2b ; … | Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect | MEDIUM 6.1 | 1.1 % |