GitHub Advisoryadvisory · PyPI

GHSA-qf3c-rw9f-jh7v Clear Text Credentials Exposed via Onboarding Task

MEDIUM Published 2023-11-21 Modified 2024-11-22 Official page ↗
Aliases
CVE-2023-48700
Ecosystem
PyPI
Packages
nautobot-device-onboarding
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-256
Reviewed
2023-11-21

Affected packages

• PyPI nautobot-device-onboarding: >= 2.0.0, < 3.0.0 → fixed in 3.0.0

Description

Impact When credentials are provided while creating an OnboardingTask they may be visible via the Job Results view under the Additional Data tab as args for the Celery Task execution. This only applies to OnboardingTasks that are created with credentials specified while on v2.0.0-2.0.2 of Nautobot Device Onboarding. This advisory does not apply earlier version or when using NAPALM_USERNAME & NAPALM_PASSWORD from nautobot_config.py Patches v3.0.0 Workarounds None Recommendations • Delete all Job Results for any onboarding task to remove clear text credentials from database entries that were run while on v2.0.X • Upgrade to v3.0.0 • Rotate any exposed credential

Related

Alias · CVE (1)

  • CVE-2023-48700 The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-256 Plaintext Storage of a Password weakness

References