nautobot-device-resources (=1.0.0), nautobot-ssot (>=2.0.0 <=2.5.0) potentially affected by CVE-2024-36112 via nautobot (>=2.0.0 <=2.2.0)

nautobot PYPI version =2.0.0, =2.0.0, =2.5.0 Source cves: CVE-2024-36112 Source advisory: OSV:GHSA-QMJF-WC2H-6X3Q...

nautobot-chatops-arista-cloudvision (>=1.0.1 <=1.3.0), nautobot-chatops-meraki (>=1.1.0 <=1.2.0) +2 more potentially affected by CVE-2024-36112 via nautobot (=1.5.16)

nautobot PYPI version =1.5.16 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-chatops-arista-cloudvision =1.0.1, =1.1.0, =1.5.0, =1.6.0 Source cves: CVE-2024-36112 Source advisory: OSV:GHSA-QMJF-WC2H-6X3Q...

nautobot-device-resources (=1.0.0), nautobot-fsus (>=2.0.0 <=2.0.2) +1 more potentially affected by CVE-2024-36112 via nautobot (>=2.0.0 <=2.2.9)

nautobot PYPI version =2.0.0, =2.0.0, =2.0.0, =2.5.0 Source cves: CVE-2024-36112 Source advisory: OSV:PYSEC-2024-166...

CVE-2024-36112 Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ t...

CVE-2024-36112

CVE-2024-36112 affects Nautobot: in 1.3.0–1.6.22 and 2.0.0–2.2.4, listing members of Dynamic Groups via the UI or API does not enforce member-object permissions, enabling a user with extras.view_dynamicgroup to see all Group members regardless of dcim.view_device. Fixed in Nautobot 1.6.23 and 2.2...