CVE-2024-8923: Sandbox Escape in Now Platform

Published Oct 29, 2024
·
Updated

ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.

Affected Software

69 affected components
ServiceNow ServiceNow=xanadu-early_availability
ServiceNow ServiceNow=xanadu-early_availability_hotfix_1
ServiceNow ServiceNow=washington_dc
ServiceNow ServiceNow=washington_dc-early_availability
ServiceNow ServiceNow=washington_dc-early_availability_hotfix_1
ServiceNow ServiceNow=washington_dc-patch_1
ServiceNow ServiceNow=washington_dc-patch_1_hotfix_1
ServiceNow ServiceNow=washington_dc-patch_1_hotfix_2
ServiceNow ServiceNow=washington_dc-patch_1_hotfix_2a
ServiceNow ServiceNow=washington_dc-patch_1_hotfix_2b
ServiceNow ServiceNow=washington_dc-patch_1_hotfix_3b
ServiceNow ServiceNow=washington_dc-patch_2
ServiceNow ServiceNow=washington_dc-patch_2_hotfix_1
ServiceNow ServiceNow=washington_dc-patch_2_hotfix_2
ServiceNow ServiceNow=washington_dc-patch_3
ServiceNow ServiceNow=washington_dc-patch_3_hotfix_1
ServiceNow ServiceNow=washington_dc-patch_3_hotfix_2
ServiceNow ServiceNow=washington_dc-patch_3_hotfix_3
ServiceNow ServiceNow=washington_dc-patch_4
ServiceNow ServiceNow=washington_dc-patch_4_hotfix_1
ServiceNow ServiceNow=vancouver
ServiceNow ServiceNow=vancouver-early_availability
ServiceNow ServiceNow=vancouver-early_availability_hotfix_1
ServiceNow ServiceNow=vancouver-early_availability_hotfix_2
ServiceNow ServiceNow=vancouver-patch_1
ServiceNow ServiceNow=vancouver-patch_1_hotfix_1
ServiceNow ServiceNow=vancouver-patch_2
ServiceNow ServiceNow=vancouver-patch_2_hotfix_1
ServiceNow ServiceNow=vancouver-patch_2_hotfix_1a
ServiceNow ServiceNow=vancouver-patch_2_hotfix_2
ServiceNow ServiceNow=vancouver-patch_2_hotfix_3
ServiceNow ServiceNow=vancouver-patch_2_hotfix1a
ServiceNow ServiceNow=vancouver-patch_3
ServiceNow ServiceNow=vancouver-patch_3_hotfix_1
ServiceNow ServiceNow=vancouver-patch_3_hotfix_2
ServiceNow ServiceNow=vancouver-patch_3_hotfix_3
ServiceNow ServiceNow=vancouver-patch_3_hotfix_4
ServiceNow ServiceNow=vancouver-patch_4
ServiceNow ServiceNow=vancouver-patch_4_hotfix_1
ServiceNow ServiceNow=vancouver-patch_4_hotfix_1a
ServiceNow ServiceNow=vancouver-patch_4_hotfix_1b
ServiceNow ServiceNow=vancouver-patch_4_hotfix_2b
ServiceNow ServiceNow=vancouver-patch_5
ServiceNow ServiceNow=vancouver-patch_5_hotfix_1
ServiceNow ServiceNow=vancouver-patch_6
ServiceNow ServiceNow=vancouver-patch_6_hotfix_1
ServiceNow ServiceNow=vancouver-patch_6_hotfix_2
ServiceNow ServiceNow=vancouver-patch_7
ServiceNow ServiceNow=vancouver-patch_7_hotfix_1
ServiceNow ServiceNow=vancouver-patch_7_hotfix_1a
ServiceNow ServiceNow=vancouver-patch_7_hotfix_2
ServiceNow ServiceNow=vancouver-patch_7_hotfix_2a
ServiceNow ServiceNow=vancouver-patch_7_hotfix_2b
ServiceNow ServiceNow=vancouver-patch_7_hotfix_3a
ServiceNow ServiceNow=vancouver-patch_7_hotfix_3b
ServiceNow ServiceNow=vancouver-patch_7_hotfix_4
ServiceNow ServiceNow=vancouver-patch_7_hotifix_1a
ServiceNow ServiceNow=vancouver-patch_7_hotifix_1b
ServiceNow ServiceNow=vancouver-patch_7_hotifix_2a
ServiceNow ServiceNow=vancouver-patch_7_hotifix_2b
ServiceNow ServiceNow=vancouver-patch_8
ServiceNow ServiceNow=vancouver-patch_8_hotfix_1
ServiceNow ServiceNow=vancouver-patch_8_hotfix_2
ServiceNow ServiceNow=vancouver-patch_8_hotfix_3
ServiceNow ServiceNow=vancouver-patch_8_hotfix_4
ServiceNow ServiceNow=vancouver-patch_8_hotfix_5
ServiceNow ServiceNow=vancouver-patch_9
ServiceNow ServiceNow=vancouver-patch_9_hotfix_1
ServiceNow ServiceNow=vancouver-patch_9_hotfix_2

Event History

Oct 29, 2024
CVE Published
via MITRE·04:07 PM
Data Sourced
via MITRE·04:07 PM
DescriptionSeverityWeakness
Apr 28, 56937
Event
via FIRST·03:47 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-8923?

CVE-2024-8923 is rated as a critical vulnerability due to its potential for remote code execution.

2

How do I fix CVE-2024-8923?

The recommended fix for CVE-2024-8923 is to update your ServiceNow instance to the latest version that addresses this vulnerability.

3

What versions of ServiceNow are affected by CVE-2024-8923?

CVE-2024-8923 affects multiple versions including xanadu, washington_dc, and vancouver series of ServiceNow.

4

What can happen if CVE-2024-8923 is exploited?

If CVE-2024-8923 is exploited, an unauthenticated user could execute arbitrary code on the server running the Now Platform.

5

Has ServiceNow released a patch for CVE-2024-8923?

Yes, ServiceNow has released patches for CVE-2024-8923 and updates are available for impacted hosted instances.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203