Arbitrary Code Execution via Glide Scripting Injection in ServiceNow Release Jakarta Patch 8 and Earlier

CVE-2018-7748 · MEDIUM Severity

AV:N/AC:L/AU:S/C:P/I:P/A:P

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter.

Learn more about our Web Application Penetration Testing UK.