Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2024-8924 Details

Description

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1706072	[email protected]	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	[email protected]
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	[email protected]

Affected Products

Product	Versions
servicenow servicenow	xanadu - xanadu early_availability xanadu early_availability_hotfix_1 vancouver - vancouver early_availability
CPE cpe:2.3:a:servicenow:servicenow:xanadu:-:::::: cpe:2.3:a:servicenow:servicenow:xanadu:early_availability:::::: cpe:2.3:a:servicenow:servicenow:xanadu:early_availability_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:-:::::: cpe:2.3:a:servicenow:servicenow:vancouver:early_availability:::::: cpe:2.3:a:servicenow:servicenow:vancouver:early_availability_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:early_availability_hotfix_2:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_1_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_10:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_10_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_2:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1a:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_2:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_3:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix1a:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_3:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_2:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_3:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_4:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_4:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1a:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1b:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_2b:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_5:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_5_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_6:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_6_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_6_hotfix_2:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1a:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2a:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2b:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_3a:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_3b:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_4:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1a:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1b:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2a:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2b:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_8:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_2:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_3:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_4:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_5:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_9:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_9_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_9_hotfix_2:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_9_hotfix_2a:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_9_hotfix_2b:::::: cpe:2.3:a:servicenow:servicenow:vancouver:patch_9_hotfix_3a:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:-:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:early_availability:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:early_availability_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2a:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2b:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_3b:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2_hotfix_2:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3_hotfix_2:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3_hotfix_3:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4_hotfix_1a:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4_hotfix_1b:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4_hotfix_2:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4_hotfix_2a:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5_hotfix_1:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5_hotfix_2:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5_hotfix_3:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5_hotfix_4:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5_hotfix_5:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5_hotfix_6:::::: cpe:2.3:a:servicenow:servicenow:washington_dc:patch_6:::::: Remediation No remediation found in references.

Product

Versions

servicenow servicenow

xanadu -

xanadu early_availability

xanadu early_availability_hotfix_1

vancouver -

vancouver early_availability

vancouver early_availability_hotfix_1

vancouver early_availability_hotfix_2

vancouver patch_1

vancouver patch_1_hotfix_1

vancouver patch_10

vancouver patch_10_hotfix_1

vancouver patch_2

vancouver patch_2_hotfix_1

vancouver patch_2_hotfix_1a

vancouver patch_2_hotfix_2

vancouver patch_2_hotfix_3

vancouver patch_2_hotfix1a

vancouver patch_3

vancouver patch_3_hotfix_1

vancouver patch_3_hotfix_2

vancouver patch_3_hotfix_3

vancouver patch_3_hotfix_4

vancouver patch_4

vancouver patch_4_hotfix_1

vancouver patch_4_hotfix_1a

vancouver patch_4_hotfix_1b

vancouver patch_4_hotfix_2b

vancouver patch_5

vancouver patch_5_hotfix_1

vancouver patch_6

vancouver patch_6_hotfix_1

vancouver patch_6_hotfix_2

vancouver patch_7

vancouver patch_7_hotfix_1

vancouver patch_7_hotfix_1a

vancouver patch_7_hotfix_2

vancouver patch_7_hotfix_2a

vancouver patch_7_hotfix_2b

vancouver patch_7_hotfix_3a

vancouver patch_7_hotfix_3b

vancouver patch_7_hotfix_4

vancouver patch_7_hotifix_1a

vancouver patch_7_hotifix_1b

vancouver patch_7_hotifix_2a

vancouver patch_7_hotifix_2b

vancouver patch_8

vancouver patch_8_hotfix_1

vancouver patch_8_hotfix_2

vancouver patch_8_hotfix_3

vancouver patch_8_hotfix_4

vancouver patch_8_hotfix_5

vancouver patch_9

vancouver patch_9_hotfix_1

vancouver patch_9_hotfix_2

vancouver patch_9_hotfix_2a

vancouver patch_9_hotfix_2b

vancouver patch_9_hotfix_3a

washington_dc -

washington_dc early_availability

washington_dc early_availability_hotfix_1

washington_dc patch_1

washington_dc patch_1_hotfix_1

washington_dc patch_1_hotfix_2

washington_dc patch_1_hotfix_2a

washington_dc patch_1_hotfix_2b

washington_dc patch_1_hotfix_3b

washington_dc patch_2

washington_dc patch_2_hotfix_1

washington_dc patch_2_hotfix_2

washington_dc patch_3

washington_dc patch_3_hotfix_1

washington_dc patch_3_hotfix_2

washington_dc patch_3_hotfix_3

washington_dc patch_4

washington_dc patch_4_hotfix_1

washington_dc patch_4_hotfix_1a

washington_dc patch_4_hotfix_1b

washington_dc patch_4_hotfix_2

washington_dc patch_4_hotfix_2a

washington_dc patch_5

washington_dc patch_5_hotfix_1

washington_dc patch_5_hotfix_2

washington_dc patch_5_hotfix_3

washington_dc patch_5_hotfix_4

washington_dc patch_5_hotfix_5

washington_dc patch_5_hotfix_6

washington_dc patch_6

CPE

cpe:2.3:a:servicenow:servicenow:xanadu:-:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:xanadu:early_availability:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:xanadu:early_availability_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:-:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:early_availability:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:early_availability_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:early_availability_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_1_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_10:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_10_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix1a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_4:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_2b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_5:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_5_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_6:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_6_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_6_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_3a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_3b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_4:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_4:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_5:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_9:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_9_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_9_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_9_hotfix_2a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_9_hotfix_2b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:vancouver:patch_9_hotfix_3a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:-:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:early_availability:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:early_availability_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_3b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3_hotfix_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4_hotfix_1a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4_hotfix_1b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4_hotfix_2a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5_hotfix_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5_hotfix_4:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5_hotfix_5:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5_hotfix_6:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_6:*:*:*:*:*:*

Remediation

No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Nov 27, 2024	Reanalysis	[email protected]
Nov 7, 2024	Initial Analysis	[email protected]
Oct 29, 2024	New CVE Received	[email protected]