CVE-2024-36112 Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ t...

Nautobot 安全漏洞

Nautobot is a web automation platform by the individual developers of Nautobot. Nautobot has a security vulnerability that stems from a mismanagement of privileges vulnerability in the Nautobot dynamic-group-members UI and REST API. Affected products and versions: Nautobot versions 1.3.0 through...

CVE-2024-36112: Improper Handling of Insufficient Permissions or Privileges

Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups/ / and/or the members REST API view /api/extras/dynamic-groups/ /members/...