CVE-2024-34707

Katalog CVE

CVSS 4.8 · Medium EPSS 0,61%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada networktocode nautobot. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.

Rincian

Terbit di NVD

14 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3 patch · advisory vendor
• https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c patch
• https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423 patch
• https://github.com/nautobot/nautobot/pull/5697 exploit · patch
• https://github.com/nautobot/nautobot/pull/5698 exploit · patch