CVE-2024-32979

2024-05-0111:15:47

CWE-79

[email protected]

web.nvd.nist.gov

nautobot

network source of truth

network automation platform

django python framework

postgresql

mysql

reflected cross-site scripting

vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L

0.0004 Low

EPSS

Percentile

15.7%

JSON

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot versions 1.6.20 and 2.2.3. There are no known workarounds for this vulnerability.

Affected configurations

Vulners

Node

nautobotnautobot-plugin-device-onboardingRange<1.6.20

nautobotnautobot-plugin-device-onboardingRange2.0.0–2.2.3

VendorProductVersionCPE
nautobotnautobot\-plugin\-device\-onboarding*cpe:2.3:a:nautobot:nautobot\-plugin\-device\-onboarding:*:*:*:*:*:*:*:*
nautobotnautobot\-plugin\-device\-onboarding*cpe:2.3:a:nautobot:nautobot\-plugin\-device\-onboarding:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nautobot	nautobot\-plugin\-device\-onboarding	*	cpe:2.3:a:nautobot:nautobot\-plugin\-device\-onboarding::::::::
nautobot	nautobot\-plugin\-device\-onboarding	*	cpe:2.3:a:nautobot:nautobot\-plugin\-device\-onboarding::::::::

CNA Affected

[
  {
    "vendor": "nautobot",
    "product": "nautobot",
    "versions": [
      {
        "version": "< 1.6.20",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.2.3",
        "status": "affected"
      }
    ]
  }
]