Lucene search
+L

2 matches found

Github Security Blog
Github Security Blog
added 2023/12/22 7:51 p.m.36 views

Nautobot missing object-level permissions enforcement when running Job Buttons

Impact When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have permission to run Jobs in general?. Object-level permissions i.e., does the user have permission to run this specific Job? are not enforced by the URL/view used ...

4.3CVSS5.4AI score0.00452EPSS
SaveExploits0References9Affected Software1
OSV
OSV
added 2023/12/22 7:51 p.m.73 views

GHSA-VF5M-XRHM-V999 Nautobot missing object-level permissions enforcement when running Job Buttons

Impact When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have permission to run Jobs in general?. Object-level permissions i.e., does the user have permission to run this specific Job? are not enforced by the URL/view used ...

3.5CVSS5.4AI score0.00452EPSS
SaveExploits0References9
Rows per page
Query Builder