CVE-2024-34707 Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

2024-05-1319:22:41

CWE-79

GitHub_M

www.cve.org

nautobot

html injection

admin privileges

security issue

cross-site scripting

vulnerability

fixed

1.6.22

2.2.4

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L

0.0004 Low

EPSS

Percentile

15.7%

JSON

Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the BANNER_TOP, BANNER_BOTTOM, and BANNER_LOGIN configuration settings via the /admin/constance/config/ endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of BANNER_LOGIN) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.

CNA Affected

[
  {
    "vendor": "nautobot",
    "product": "nautobot",
    "versions": [
      {
        "version": "< 1.6.22",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.2.4",
        "status": "affected"
      }
    ]
  }
]