CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.
Products
Nautobot
- 1.6.22
- 2.2.4
Source
security-advisories@github.com
Tags
CVE-2024-34707 details
Last Modified : May 14, 2024, 4:12 p.m.
Description
Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7.5 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
LOW
Base Score
7.5
Exploitability Score
Impact Score
Base Severity
HIGH
Vector String : CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L
References
| URL | Source |
|---|---|
| https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c | security-advisories@github.com |
| https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423 | security-advisories@github.com |
| https://github.com/nautobot/nautobot/pull/5697 | security-advisories@github.com |
| https://github.com/nautobot/nautobot/pull/5698 | security-advisories@github.com |
| https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3 | security-advisories@github.com |