Lucene search
+L

2 matches found

Github Security Blog
Github Security Blog
added 2023/12/22 7:51 p.m.40 views

Nautobot missing object-level permissions enforcement when running Job Buttons

Impact When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have permission to run Jobs in general?. Object-level permissions i.e., does the user have permission to run this specific Job? are not enforced by the URL/view used ...

4.3CVSS5.4AI score0.00452EPSS
SaveExploits0References9Affected Software1
Rows per page
Query Builder