CVE-2024-32979

MEDIUM EPSS 38.5%
Published May 1, 20242y ago · Modified Jun 17, 20261w ago
6.1 CVSS 3.1
Medium
Find Similar
Published May 1, 2024 2y ago
Last Modified Jun 17, 2026 1w ago

Description

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot versions 1.6.20 and 2.2.3. There are no known workarounds for this vulnerability.

CVSS Details

Base Score
6.1
Exploitability
2.8
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
38.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 2

VendorProductVersionRange
networktocodenautobot*≥1.5.0  –  <1.6.20
networktocodenautobot*≥2.0.0  –  <2.2.3

References 4

  • github.com https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e
    Patch
  • github.com https://github.com/nautobot/nautobot/pull/5646
    Patch
  • github.com https://github.com/nautobot/nautobot/pull/5647
    Patch
  • github.com https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg
    Third Party Advisory

Remediation

  • github.com https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e
    Patch
  • github.com https://github.com/nautobot/nautobot/pull/5646
    Patch
  • github.com https://github.com/nautobot/nautobot/pull/5647
    Patch