Log in Start free

Vulnerability · Published May 13, 2024 · Assigned by GitHub_M

CVE-2024-34707Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

High 7.5

In plain English

A high-severity cross-site scripting in nautobot from nautobot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 50.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPInautobot1.6.22GHSA-r2hr-4v48-fjv3
PyPInautobot2.2.4GHSA-r2hr-4v48-fjv3
PyPInautobot1.6.22, 2.2.4PYSEC-2026-1688

Affected products (as reported)

VendorProductVersions
nautobot nautobot < 1.6.22>= 2.0.0, < 2.2.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L

References