github - ghsa-4w9h-2rq9-697c

GHSA-4W9H-2RQ9-697C

Vulnerability from github – Published: 2024-12-02 21:31 – Updated: 2024-12-02 21:31

Details

ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.

Severity ?

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-5890"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-02T19:15:12Z",
    "severity": "MODERATE"
  },
  "details": "ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.\n\nServiceNow released updates\u00a0to customers that addressed this vulnerability.  If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.",
  "id": "GHSA-4w9h-2rq9-697c",
  "modified": "2024-12-02T21:31:19Z",
  "published": "2024-12-02T21:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5890"
    },
    {
      "type": "WEB",
      "url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB1710511"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2024-5890 (GCVE-0-2024-5890)

Vulnerability from cvelistv5 – Published: 2024-12-02 18:24 – Updated: 2024-12-02 19:21

Summary

ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website. ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.

Severity ?

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

References

URL

Tags

https://support.servicenow.com/kb?id=kb_article_v…

Impacted products

	Vendor	Product	Version
	ServiceNow	Now Platform	Affected: 0 , < Utah Patch 8 Hot Fix 1 (custom) Affected: 0 , < Vancouver Patch 10 (custom) Affected: 0 , < Vancouver Patch 9 (custom) Affected: 0 , < Washington DC Early Access (custom)

Credits

Alexandre Rodrigo Da Silva

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-5890",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-02T19:20:40.477397Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-02T19:21:08.073Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Now Platform",
          "vendor": "ServiceNow",
          "versions": [
            {
              "lessThan": "Utah Patch 8 Hot Fix 1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Vancouver Patch 10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Vancouver Patch 9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Washington DC Early Access",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexandre Rodrigo Da Silva"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow has addressed an HTML injection vulnerability that was \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eidentified\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e in the Now Platform. This vulnerability could\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e potentially\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e enable an unauthenticated user to \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003emodify\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ea\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eweb \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003epage\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e or redirect users to another \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ewebsite\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ereleased\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eupdate\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003es\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;to customers\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e that addressed this vulnerability\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.  \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIf you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.\n\nServiceNow released updates\u00a0to customers that addressed this vulnerability.  If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-02T18:24:55.797Z",
        "orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
        "shortName": "SN"
      },
      "references": [
        {
          "url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB1710511"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HTML Injection in the Assessment plugin",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
    "assignerShortName": "SN",
    "cveId": "CVE-2024-5890",
    "datePublished": "2024-12-02T18:24:55.797Z",
    "dateReserved": "2024-06-12T00:02:00.934Z",
    "dateUpdated": "2024-12-02T19:21:08.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-4W9H-2RQ9-697C

CVE-2024-5890 (GCVE-0-2024-5890)

Tags

Sightings

Nomenclature