Lucene search
Veracode Vulnerability DatabaseVERACODE:39428HistoryFeb 26, 2023 - 4:51 p.m.
Remote Code Execution (RCE)
2023-02-2616:51:48
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
8
remote code execution
nautobot
vulnerability
jinja2
template engine
sandbox
computedfield
customlink
exporttemplate
secret
webhook
template code
render_jinja2
helper function
security
0.008 Low
EPSS
Percentile
81.9%
nautobot is vulnerable to Remote Code Execution (RCE). The vulnerability is due to improper sandboxing of environments for the Jinja2 template engine when used internally for template rendering for objects like extras.ComputedField,extras.CustomLink, extras.ExportTemplate, extras.Secret and extras.Webhook which allows an attacker to inject and execute maliciously crafted template code through the nautobot.utilities.utils.render_jinja2 helper function
Related
github
github
Nautobot vulnerable to remote code execution via Jinja2 template rendering
2023-02-22 00:04:02
osv
osv
Nautobot vulnerable to remote code execution via Jinja2 template rendering
2023-02-22 00:04:02
PYSEC-2023-37
2023-02-21 21:15:00
CVE-2023-25657
2023-02-21 21:15:11
cvelist
cvelist
cve
cve
CVE-2023-25657
2023-02-21 21:15:11
prion
prion
Remote code execution
2023-02-21 21:15:00
nvd
nvd
CVE-2023-25657
2023-02-21 21:15:11