GitHub Advisoryadvisory · PyPI

GHSA-v4xv-795h-rv4h XSS potential in rendered Markdown fields (comments, description, notes, etc.)

HIGH Published 2024-01-23 Modified 2024-01-23 Official page ↗
Aliases
CVE-2024-23345
Ecosystem
PyPI
Packages
nautobot
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weaknesses
CWE-79
Reviewed
2024-01-23

Affected packages

• PyPI nautobot: >= 2.0.0, < 2.1.2 → fixed in 2.1.2 • PyPI nautobot: < 1.6.10 → fixed in 1.6.10

Description

Impact All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including: • `Circuit.comments` • `Cluster.comments` • `CustomField.description` • `Device.comments` • `DeviceRedundancyGroup.comments` • `DeviceType.comments` • `Job.description` • `JobLogEntry.message` • `Location.comments` • `Note.note` • `PowerFeed.comments` • `Provider.noc_contact` • `Provider.admin_contact` • `Provider.comments` • `ProviderNetwork.comments` • `Rack.comments` • `Tenant.comments` • `VirtualMachine.comments` • Contents of any custom fields of type `markdown` • Job class `description` attributes • The `SUPPORT_MESSAGE` system configuration setting are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. Patches Fixed in Nautobot versions 1.6.10 and 2.1.2. References https://github.com/nautobot/nautobot/pull/5133 https://github.com/nautobot/nautobot/pull/5134

Related

Alias · CVE (1)

  • CVE-2024-23345 Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References