What’s Vulnerable › Vulnerabilities
CVE-2024-5890: HTML Injection in the Assessment plugin
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-12-02 · updated 2026-06-17
- Weakness: CWE-79
Description
ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website. ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.
Affected products
- ServiceNow Now Platform: before Utah Patch 8 Hot Fix 1; before Vancouver Patch 10; before Vancouver Patch 9; before Washington DC Early Access — fixed in Utah Patch 8 Hot Fix 1, Vancouver Patch 10, Vancouver Patch 9, Washington DC Early Access
How to fix
Upgrade to a fixed version: ServiceNow Now Platform Utah Patch 8 Hot Fix 1, Vancouver Patch 10, Vancouver Patch 9, Washington DC Early Access. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-5890 or the next vulnerability affects your stack