CVE-2024-5178 is a sensitive file read vulnerability in ServiceNow's Washington DC, Vancouver, and Utah Now Platform releases, allowing administrative users to access sensitive files on the web application server. Rated Medium (CVSS 4.9), it requires high privileges but has low attack complexity, potentially leading to unauthorized information disclosure. While not listed in KEV, it has garnered significant community discussion and media coverage, with reports of other critical ServiceNow flaws being actively exploited, though specific exploit code for CVE-2024-5178 is not publicly available. ServiceNow has released patches and hotfixes, which are recommended for immediate application.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| ServiceNow | Now Platform | >= 0, < Utah Patch 10 Hot Fix 3, >= 0, < Utah Patch 10a Hot Fix 2, >= 0, < Utah Patch 10b Hot Fix 1, >= 0, < Vancouver Patch 10, >= 0, < Vancouver Patch 6 Hot Fix 2, >= 0, < Vancouver Patch 7 Hot Fix 3b, >= 0, < Vancouver Patch 8 Hot Fix 4, >= 0, < Vancouver Patch 9 Hot Fix 1, >= 0, < Washington DC Patch 1 Hot Fix 3b, >= 0, < Washington DC Patch 2 Hot Fix 2, >= 0, < Washington DC Patch 3 Hot Fix 2, >= 0, < Washington DC Patch 4CNA affecteddefault unaffected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.