CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-36112 – Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects
https://notcve.org/view.php?id=CVE-2024-36112
28 May 2024 — Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI view (`/extras/dynamic-groups/
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-34707 – Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
https://notcve.org/view.php?id=CVE-2024-34707
13 May 2024 — Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTM... • https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-32979 – Reflected Cross-site Scripting potential in all object list views in Nautobot
https://notcve.org/view.php?id=CVE-2024-32979
01 May 2024 — Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot version... • https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-29199 – Unauthenticated views may expose information to anonymous users
https://notcve.org/view.php?id=CVE-2024-29199
26 Mar 2024 — Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9. Nautobot es una platafor... • https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23345 – Nautobot has XSS potential in rendered Markdown fields
https://notcve.org/view.php?id=CVE-2024-23345
22 Jan 2024 — Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2. Nautobot es una plataforma ... • https://github.com/nautobot/nautobot/commit/17effcbe84a72150c82b138565c311bbee357e80 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-51649 – Nautobot missing object-level permissions enforcement when running Job Buttons
https://notcve.org/view.php?id=CVE-2023-51649
22 Dec 2023 — Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even... • https://github.com/nautobot/nautobot/issues/4988 • CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-50263 – Nautobot allows unauthenticated db-file-storage views
https://notcve.org/view.php?id=CVE-2023-50263
12 Dec 2023 — Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs `/files/get/?name=...` and `/files/download/?name=...` are used to provide admin access to files that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these files are ephemeral and are deleted once the Job in question runs. • https://github.com/nautobot/nautobot/commit/458280c359a4833a20da294eaf4b8d55edc91cee • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-306: Missing Authentication for Critical Function •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-48705 – nautobot has XSS potential in custom links, job buttons, and computed fields
https://notcve.org/view.php?id=CVE-2023-48705
22 Nov 2023 — Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are potentially affected by a cross-site scripting vulnerability. Due to incorrect usage of Django's `mark_safe()` API when rendering certain types of user-authored content; including custom links, job buttons, and computed fields; it is possible that users with permission to create or edit these types of content could craft a malicious payload (such as ... • https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-46128 – Exposure of hashed user passwords via REST API in Nautobot
https://notcve.org/view.php?id=CVE-2023-46128
24 Oct 2023 — Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the `?depth=<N>` query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3. • https://github.com/nautobot/nautobot/commit/1ce8e5c658a075c29554d517cd453675e5d40d71 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-312: Cleartext Storage of Sensitive Information •