CVE-2024-23345

Katalog CVE

CVSS 5.4 · Medium EPSS 0,43%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada networktocode nautobot. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.

Rincian

Terbit di NVD

23 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nautobot/nautobot/security/advisories/GHSA-v4xv-795h-rv4h advisory vendor
• https://github.com/nautobot/nautobot/commit/17effcbe84a72150c82b138565c311bbee357e80 patch
• https://github.com/nautobot/nautobot/commit/64312a4297b5ca49b6cdedf477e41e8e4fd61cce patch
• https://github.com/nautobot/nautobot/pull/5133 patch
• https://github.com/nautobot/nautobot/pull/5134 patch