CVE-2024-29199
Vulnerability from cvelistv5
Published
2024-03-26 03:08
Modified
2024-08-02 16:13
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9.
References
security-advisories@github.comhttps://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750
security-advisories@github.comhttps://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb
security-advisories@github.comhttps://github.com/nautobot/nautobot/pull/5464
security-advisories@github.comhttps://github.com/nautobot/nautobot/pull/5465
security-advisories@github.comhttps://github.com/nautobot/nautobot/releases/tag/v1.6.16
security-advisories@github.comhttps://github.com/nautobot/nautobot/releases/tag/v2.1.9
security-advisories@github.comhttps://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4
af854a3a-2127-422b-91ae-364da2661108https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750
af854a3a-2127-422b-91ae-364da2661108https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb
af854a3a-2127-422b-91ae-364da2661108https://github.com/nautobot/nautobot/pull/5464
af854a3a-2127-422b-91ae-364da2661108https://github.com/nautobot/nautobot/pull/5465
af854a3a-2127-422b-91ae-364da2661108https://github.com/nautobot/nautobot/releases/tag/v1.6.16
af854a3a-2127-422b-91ae-364da2661108https://github.com/nautobot/nautobot/releases/tag/v2.1.9
af854a3a-2127-422b-91ae-364da2661108https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4
Impacted products
Vendor Product Version
nautobot nautobot Version: < 1.6.16
Version: >= 2.0.0, < 2.1.9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:10:54.048Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4"
          },
          {
            "name": "https://github.com/nautobot/nautobot/pull/5464",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/pull/5464"
          },
          {
            "name": "https://github.com/nautobot/nautobot/pull/5465",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/pull/5465"
          },
          {
            "name": "https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750"
          },
          {
            "name": "https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb"
          },
          {
            "name": "https://github.com/nautobot/nautobot/releases/tag/v1.6.16",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/releases/tag/v1.6.16"
          },
          {
            "name": "https://github.com/nautobot/nautobot/releases/tag/v2.1.9",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/releases/tag/v2.1.9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-29199",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-02T16:13:02.596894Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:13:27.128Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nautobot",
          "vendor": "nautobot",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-26T03:08:21.873Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4"
        },
        {
          "name": "https://github.com/nautobot/nautobot/pull/5464",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/pull/5464"
        },
        {
          "name": "https://github.com/nautobot/nautobot/pull/5465",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/pull/5465"
        },
        {
          "name": "https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750"
        },
        {
          "name": "https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb"
        },
        {
          "name": "https://github.com/nautobot/nautobot/releases/tag/v1.6.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/releases/tag/v1.6.16"
        },
        {
          "name": "https://github.com/nautobot/nautobot/releases/tag/v2.1.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/releases/tag/v2.1.9"
        }
      ],
      "source": {
        "advisory": "GHSA-m732-wvh2-7cq4",
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated views may expose information to anonymous users"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-29199",
    "datePublished": "2024-03-26T03:08:21.873Z",
    "dateReserved": "2024-03-18T17:07:00.095Z",
    "dateUpdated": "2024-08-02T16:13:27.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-29199\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-03-26T03:15:13.707\",\"lastModified\":\"2024-11-21T09:07:47.030\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9.\"},{\"lang\":\"es\",\"value\":\"Nautobot es una plataforma de automatizaci\u00f3n de redes y fuente de verdad de red. Se descubri\u00f3 que varios endpoints de URL de Nautobot no eran accesibles correctamente para usuarios no autenticados (an\u00f3nimos). Estos endpoints no revelar\u00e1n ning\u00fan dato de Nautobot a un usuario no autenticado a menos que la variable de configuraci\u00f3n de Nautobot EXEMPT_VIEW_PERMISSIONS se cambie de su valor predeterminado (una lista vac\u00eda) para permitir el acceso a datos espec\u00edficos por parte de usuarios no autenticados. Esta vulnerabilidad se solucion\u00f3 en 1.6.16 y 2.1.9.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":3.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nautobot/nautobot/pull/5464\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nautobot/nautobot/pull/5465\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nautobot/nautobot/releases/tag/v1.6.16\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nautobot/nautobot/releases/tag/v2.1.9\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/nautobot/nautobot/pull/5464\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/nautobot/nautobot/pull/5465\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/nautobot/nautobot/releases/tag/v1.6.16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/nautobot/nautobot/releases/tag/v2.1.9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4\", \"name\": \"https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/nautobot/nautobot/pull/5464\", \"name\": \"https://github.com/nautobot/nautobot/pull/5464\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nautobot/nautobot/pull/5465\", \"name\": \"https://github.com/nautobot/nautobot/pull/5465\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750\", \"name\": \"https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb\", \"name\": \"https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nautobot/nautobot/releases/tag/v1.6.16\", \"name\": \"https://github.com/nautobot/nautobot/releases/tag/v1.6.16\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nautobot/nautobot/releases/tag/v2.1.9\", \"name\": \"https://github.com/nautobot/nautobot/releases/tag/v2.1.9\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T01:10:54.048Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-29199\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-02T16:13:02.596894Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-02T16:13:09.186Z\"}}], \"cna\": {\"title\": \"Unauthenticated views may expose information to anonymous users\", \"source\": {\"advisory\": \"GHSA-m732-wvh2-7cq4\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"nautobot\", \"product\": \"nautobot\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.6.16\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.0.0, \u003c 2.1.9\"}]}], \"references\": [{\"url\": \"https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4\", \"name\": \"https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/nautobot/nautobot/pull/5464\", \"name\": \"https://github.com/nautobot/nautobot/pull/5464\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nautobot/nautobot/pull/5465\", \"name\": \"https://github.com/nautobot/nautobot/pull/5465\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750\", \"name\": \"https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb\", \"name\": \"https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nautobot/nautobot/releases/tag/v1.6.16\", \"name\": \"https://github.com/nautobot/nautobot/releases/tag/v1.6.16\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nautobot/nautobot/releases/tag/v2.1.9\", \"name\": \"https://github.com/nautobot/nautobot/releases/tag/v2.1.9\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-03-26T03:08:21.873Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-29199\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T16:13:27.128Z\", \"dateReserved\": \"2024-03-18T17:07:00.095Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-03-26T03:08:21.873Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.