CVE-2023-48700

2023-11-2123:15:08

CWE-256

CWE-312

[email protected]

web.nvd.nist.gov

nautobot

device onboarding

plugin

security

vulnerability

credentials

netmiko

napalm

mitigation

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

21.8%

JSON

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are visible via Job Results from an execution of an Onboarding Task. Version 3.0.0 fixes this issue; no known workarounds are available. Mitigation recommendations include deleting all Job Results for any onboarding task to remove clear text credentials from database entries that were run while on v2.0.X, upgrading to v3.0.0, and rotating any exposed credentials.

Affected configurations

Vulners

NVD

Node

nautobotnautobot-plugin-device-onboardingRange2.0.0–3.0.0

VendorProductVersionCPE
nautobotnautobot\-plugin\-device\-onboarding*cpe:2.3:a:nautobot:nautobot\-plugin\-device\-onboarding:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nautobot	nautobot\-plugin\-device\-onboarding	*	cpe:2.3:a:nautobot:nautobot\-plugin\-device\-onboarding::::::::

CNA Affected

[
  {
    "vendor": "nautobot",
    "product": "nautobot-plugin-device-onboarding",
    "versions": [
      {
        "version": ">= 2.0.0, < 3.0.0",
        "status": "affected"
      }
    ]
  }
]