CVE-2024-34707
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L
Summary
Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the BANNER_TOP, BANNER_BOTTOM, and BANNER_LOGIN configuration settings via the /admin/constance/config/ endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of BANNER_LOGIN) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| nautobot | nautobot | < 1.6.22 | affected |
| nautobot | nautobot | >= 2.0.0, < 2.2.4 | affected |
Weaknesses
- CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
CVE Program Container
Additional References
- https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3
- https://github.com/nautobot/nautobot/pull/5697
- https://github.com/nautobot/nautobot/pull/5698
- https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c
- https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423
References
- https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3
- https://github.com/nautobot/nautobot/pull/5697
- https://github.com/nautobot/nautobot/pull/5698
- https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c
- https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.