CVE-2024-32979

Reflected Cross-site Scripting potential in all object list views in Nautobot

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot versions 1.6.20 and 2.2.3. There are no known workarounds for this vulnerability.

Nautobot es una plataforma de automatización de redes y fuente de verdad de red creada como una aplicación web sobre el framework Django Python con una base de datos PostgreSQL o MySQL. Se descubrió que debido al manejo inadecuado y al escape de los parámetros de consulta proporcionados por el usuario, una URL de Nautobot manipulada con fines malintencionados podría usarse para ejecutar un ataque de Cross-Site Scripting Reflejado (Reflected XSS) contra los usuarios. Todas las vistas de lista de objetos filtrables en Nautobot son vulnerables. Este problema se solucionó en las versiones 1.6.20 y 2.2.3 de Nautobot. No se conocen workarounds para esta vulnerabilidad.

*Credits: N/A

CVSS Scores

GitHubv3.1 7.5

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-04-22 CVE Reserved
2024-05-01 CVE Published
2024-05-02 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (4)

URL	Tag	Source
https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e	X_refsource_misc
https://github.com/nautobot/nautobot/pull/5646	X_refsource_misc
https://github.com/nautobot/nautobot/pull/5647	X_refsource_misc
https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Nautobot Search vendor "Nautobot"		Nautobot Search vendor "Nautobot" for product "Nautobot"				< 1.6.20 Search vendor "Nautobot" for product "Nautobot" and version " < 1.6.20"		en		Affected
Nautobot Search vendor "Nautobot"		Nautobot Search vendor "Nautobot" for product "Nautobot"				>= 2.0.0 < 2.2.3 Search vendor "Nautobot" for product "Nautobot" and version " >= 2.0.0 < 2.2.3"		en		Affected