← Back

CVE-2018-7748

nvd nist
Published: Aug 3, 2018Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter.

Affected (12)

Servicenow
1 product
Servicenow
Configuration A
12 vulnerable
Vulnerable SoftwareAffected Versions
Servicenow
Servicenow
Version jakarta
Servicenow
Version jakarta p1
Servicenow
Version jakarta p2
Servicenow
Version jakarta p3
Servicenow
Version jakarta p3a
Servicenow
Version jakarta p3b
Servicenow
Version jakarta p4
Servicenow
Version jakarta p5
Servicenow
Version jakarta p6
Servicenow
Version jakarta p6a
Servicenow
Version jakarta p7
Servicenow
Version jakarta p8

Related CWEs

CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory

Timeline

No history available yet.