CVE-2024-5890 HTML Injection in the Assessment plugin
Unauthenticated attackers can inject HTML to modify web pages or redirect users in the ServiceNow Now Platform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-5890?
CVE-2024-5890 is a medium-severity cross-site scripting vulnerability in ServiceNow Now Platform, published on 2 Dec 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.
ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.
Weakness: CWE-79
Which versions are affected by CVE-2024-5890?
How do I fix CVE-2024-5890?
No fix has been published for CVE-2024-5890 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-5890 being exploited?
There is no known exploitation of CVE-2024-5890 in the wild and no public exploit code.
Sources
Also known as GHSA-4w9h-2rq9-697c.