CVE-2023-51649

Katalog CVE

CVSS 4.3 · Medium EPSS 0,45%

Kerentanan Incorrect Authorization pada networktocode nautobot. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0

Rincian

Terbit di NVD

22 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nautobot/nautobot/security/advisories/GHSA-vf5m-xrhm-v999 patch · advisory vendor
• https://github.com/nautobot/nautobot/pull/4993 issue tracking · patch
• https://github.com/nautobot/nautobot/pull/4995 issue tracking · patch
• https://github.com/nautobot/nautobot/issues/4988 issue tracking