CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-36112 – Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects
https://notcve.org/view.php?id=CVE-2024-36112
Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI view (`/extras/dynamic-groups/<uuid>/`) and/or the members REST API view (`/api/extras/dynamic-groups/<uuid>/members/`) to list the objects that are members of a given Dynamic Group. In versions of Nautobot between 1.3.0 (where the Dynamic Groups feature was added) and 1.6.22 inclusive, and 2.0.0 through 2.2.4 inclusive, Nautobot fails to restrict these listings based on the member object permissions - for example a Dynamic Group of Device objects will list all Devices that it contains, regardless of the user's `dcim.view_device` permissions or lack thereof. This issue has been fixed in Nautobot versions 1.6.23 and 2.2.5. Users are advised to upgrade. • https://github.com/nautobot/nautobot/pull/5757 https://github.com/nautobot/nautobot/pull/5762 https://github.com/nautobot/nautobot/security/advisories/GHSA-qmjf-wc2h-6x3q • CWE-280: Improper Handling of Insufficient Permissions or Privileges CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-34707 – Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
https://notcve.org/view.php?id=CVE-2024-34707
Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4. Nautobot es una plataforma de automatización de redes y fuente de verdad de red. • https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423 https://github.com/nautobot/nautobot/pull/5697 https://github.com/nautobot/nautobot/pull/5698 https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-32979 – Reflected Cross-site Scripting potential in all object list views in Nautobot
https://notcve.org/view.php?id=CVE-2024-32979
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot versions 1.6.20 and 2.2.3. There are no known workarounds for this vulnerability. • https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e https://github.com/nautobot/nautobot/pull/5646 https://github.com/nautobot/nautobot/pull/5647 https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-29199 – Unauthenticated views may expose information to anonymous users
https://notcve.org/view.php?id=CVE-2024-29199
Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9. Nautobot es una plataforma de automatización de redes y fuente de verdad de red. • https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750 https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb https://github.com/nautobot/nautobot/pull/5464 https://github.com/nautobot/nautobot/pull/5465 https://github.com/nautobot/nautobot/releases/tag/v1.6.16 https://github.com/nautobot/nautobot/releases/tag/v2.1.9 https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23345 – Nautobot has XSS potential in rendered Markdown fields
https://notcve.org/view.php?id=CVE-2024-23345
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2. Nautobot es una plataforma de automatización de redes y fuente de verdad de red creada como una aplicación web. • https://github.com/nautobot/nautobot/commit/17effcbe84a72150c82b138565c311bbee357e80 https://github.com/nautobot/nautobot/commit/64312a4297b5ca49b6cdedf477e41e8e4fd61cce https://github.com/nautobot/nautobot/pull/5133 https://github.com/nautobot/nautobot/pull/5134 https://github.com/nautobot/nautobot/security/advisories/GHSA-v4xv-795h-rv4h • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •