🔴 Critical: Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL
-
ServiceNow has shipped patches for four security vulnerabilities affecting its AI Platform, with three of them carrying a perfect CVSS 10.0 severity rating. Under specific conditions, these flaws could be exploited by an unauthenticated attacker, potentially leading to arbitrary code execution or SQL injection.
The vendor has already deployed a security update to its hosted instances and provided the corresponding fixes to partners and self-hosted customers. Organizations running their own instances are urged to apply the updates immediately, as the risk of exploitation remains high given the maximum severity score.
- Three of the four flaws are rated 10.0 on the CVSS scale.
- The vulnerabilities affect the ServiceNow AI Platform.
- Exploitation may allow unauthenticated code execution or SQL injection.
- Patches are available for hosted, partner-managed, and self-hosted environments.
Given the critical nature of these issues, administrators should prioritize verifying their patch status and confirming that no unauthorized access has occurred within their environments.
Source: The Hacker News
Has your organization completed the patching process for these ServiceNow vulnerabilities, and are you monitoring for any signs of exploitation?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login