CVE-2018-7748 Code injection in n/a

What is CVE-2018-7748?

CVE-2018-7748 is a high-severity code injection vulnerability in n/a, published on 3 Aug 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter.

Weakness: CWE-94

Which versions are affected by CVE-2018-7748?

It affects 1 product.

Products include Servicenow Servicenow.

How do I fix CVE-2018-7748?

No fix has been published for CVE-2018-7748 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-7748 being exploited?

There is no known exploitation of CVE-2018-7748 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-4879 ServiceNow Improper Input Validation Exploited Critical 9.3
• CVE-2024-5217 ServiceNow Incomplete List of Disallowed Inputs Exploited Critical 9.2
• CVE-2022-43684 ACL bypass in Reporting functionality Critical 9.9
• CVE-2024-8923 Sandbox Escape in Now Platform Critical 9.3
• CVE-2024-8924 Unauthenticated Blind SQL Injection in Core Platform High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jr5p-cp4r-9w3c.