CVE-2023-48700 Clear Text Credentials Exposed via Onboarding Task

2023-11-2122:30:58

CWE-256

CWE-312

GitHub_M

www.cve.org

cve-2023-48700

clear text credentials

onboarding task

nautobot

netmiko

napalm

database entries

vulnerability

mitigation

upgrading

5.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

21.8%

JSON

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are visible via Job Results from an execution of an Onboarding Task. Version 3.0.0 fixes this issue; no known workarounds are available. Mitigation recommendations include deleting all Job Results for any onboarding task to remove clear text credentials from database entries that were run while on v2.0.X, upgrading to v3.0.0, and rotating any exposed credentials.

CNA Affected

[
  {
    "vendor": "nautobot",
    "product": "nautobot-plugin-device-onboarding",
    "versions": [
      {
        "version": ">= 2.0.0, < 3.0.0",
        "status": "affected"
      }
    ]
  }
]