NuytsTech Security

CVE-2018-7748

by ·

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via ‘${xyz}’ Glide Scripting Injection in the sysparm_media parameter.

Date published : 2018-08-03

https://telekomsecurity.github.io/2018/07/servicenow-privilege-escalation.html

https://telekomsecurity.github.io/assets/advisories/20180104_ServiceNow_GlideInjection.txt

Tags: