Glide Scripting Injection Vulnerability in ServiceNow by ServiceNow
CVE-2018-7748

8.8HIGH

Key Information:

Vendor

Servicenow

Status
Servicenow
Vendor
CVE Published:
3 August 2018

What is CVE-2018-7748?

A vulnerability exists in report_viewer.do of ServiceNow that enables remote attackers to execute arbitrary code via crafted input in the sysparm_media parameter, exploiting Glide Scripting Injection. This vulnerability affects ServiceNow Release Jakarta Patch 8 and earlier, potentially allowing unauthorized users to gain access to sensitive system functionalities and execute malicious scripts within the application environment.

References

https://telekomsecurity.github.io/2018/07/servicenow-priv...
x_refsource_MISC
https://telekomsecurity.github.io/assets/advisories/20180...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2018-7748 : Glide Scripting Injection Vulnerability in ServiceNow by ServiceNow