Vulnerability-Lookup

CVE-2024-34707 (GCVE-0-2024-34707)

Vulnerability from cvelistv5 – Published: 2024-05-13 19:22 – Updated: 2024-08-02 02:59

Title

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

Summary

Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-15 15:20 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root Scorecard

References

5 references

URL	Tags
https://github.com/nautobot/nautobot/security/adv…	x_refsource_CONFIRM
https://github.com/nautobot/nautobot/pull/5697	x_refsource_MISC
https://github.com/nautobot/nautobot/pull/5698	x_refsource_MISC
https://github.com/nautobot/nautobot/commit/4f0a6…	x_refsource_MISC
https://github.com/nautobot/nautobot/commit/f640a…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
nautobot	nautobot	Affected: < 1.6.22 Affected: >= 2.0.0, < 2.2.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-34707",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-15T15:20:33.233925Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:41:11.308Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:59:22.584Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3"
          },
          {
            "name": "https://github.com/nautobot/nautobot/pull/5697",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/pull/5697"
          },
          {
            "name": "https://github.com/nautobot/nautobot/pull/5698",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/pull/5698"
          },
          {
            "name": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c"
          },
          {
            "name": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nautobot",
          "vendor": "nautobot",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.2.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-13T19:22:41.202Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3"
        },
        {
          "name": "https://github.com/nautobot/nautobot/pull/5697",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/pull/5697"
        },
        {
          "name": "https://github.com/nautobot/nautobot/pull/5698",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/pull/5698"
        },
        {
          "name": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c"
        },
        {
          "name": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423"
        }
      ],
      "source": {
        "advisory": "GHSA-r2hr-4v48-fjv3",
        "discovery": "UNKNOWN"
      },
      "title": "Nautobot\u0027s BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-34707",
    "datePublished": "2024-05-13T19:22:41.202Z",
    "dateReserved": "2024-05-07T13:53:00.133Z",
    "dateUpdated": "2024-08-02T02:59:22.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-34707",
      "date": "2026-10-01",
      "epss": "0.00606",
      "percentile": "0.4707"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4."
        },
        {
          "lang": "es",
          "value": "Nautobot es una plataforma de automatizaci\u00f3n de redes y fuente de verdad de red. Un usuario de Nautobot con privilegios de administrador puede modificar los ajustes de configuraci\u00f3n `BANNER_TOP`, `BANNER_BOTTOM` y `BANNER_LOGIN` a trav\u00e9s del endpoint `/admin/constance/config/`. Normalmente, estas configuraciones se usan para proporcionar texto de banner personalizado en la parte superior e inferior de todas las p\u00e1ginas web de Nautobot (o espec\u00edficamente en la p\u00e1gina de inicio de sesi\u00f3n en el caso de `BANNER_LOGIN`), pero se inform\u00f3 que un usuario administrador puede hacer uso de estas configuraciones para inyectar HTML arbitrario, exponiendo potencialmente a los usuarios de Nautobot a problemas de seguridad como Cross Site Scripting (XSS almacenados). La vulnerabilidad est\u00e1 solucionada en Nautobot 1.6.22 y 2.2.4."
        }
      ],
      "id": "CVE-2024-34707",
      "lastModified": "2024-11-21T09:19:14.290",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L",
              "version": "3.1"
            },
            "exploitabilityScore": 1.7,
            "impactScore": 5.3,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-05-14T15:39:30.633",
      "references": [
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/nautobot/nautobot/pull/5697"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/nautobot/nautobot/pull/5698"
        },
        {
          "source": "security-advisories@github.com",
          "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/nautobot/nautobot/pull/5697"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/nautobot/nautobot/pull/5698"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-79"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "nautobot",
                "vendor": "nautobot",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.6.22"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.0.0, \u003c 2.2.4"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "874653B2-E8A9-468F-83FB-62C55FAAD853",
                    "versionEndExcluding": "1.6.22",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DE1E130B-18D5-4A29-949D-549103B3AC12",
                    "versionEndExcluding": "2.2.4",
                    "versionStartIncluding": "2.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4."
          },
          {
            "lang": "es",
            "value": "Nautobot es una plataforma de automatizaci\u00f3n de redes y fuente de verdad de red. Un usuario de Nautobot con privilegios de administrador puede modificar los ajustes de configuraci\u00f3n `BANNER_TOP`, `BANNER_BOTTOM` y `BANNER_LOGIN` a trav\u00e9s del endpoint `/admin/constance/config/`. Normalmente, estas configuraciones se usan para proporcionar texto de banner personalizado en la parte superior e inferior de todas las p\u00e1ginas web de Nautobot (o espec\u00edficamente en la p\u00e1gina de inicio de sesi\u00f3n en el caso de `BANNER_LOGIN`), pero se inform\u00f3 que un usuario administrador puede hacer uso de estas configuraciones para inyectar HTML arbitrario, exponiendo potencialmente a los usuarios de Nautobot a problemas de seguridad como Cross Site Scripting (XSS almacenados). La vulnerabilidad est\u00e1 solucionada en Nautobot 1.6.22 y 2.2.4."
          }
        ],
        "id": "CVE-2024-34707",
        "lastModified": "2026-06-17T07:33:54.840",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.7,
              "impactScore": 5.3,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.7,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-34707",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-15T15:20:33.233925Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-14T15:39:30.633",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Patch"
            ],
            "url": "https://github.com/nautobot/nautobot/pull/5697"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Patch"
            ],
            "url": "https://github.com/nautobot/nautobot/pull/5698"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Patch"
            ],
            "url": "https://github.com/nautobot/nautobot/pull/5697"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Patch"
            ],
            "url": "https://github.com/nautobot/nautobot/pull/5698"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-01-09T08:35:07+00:00",
      "cve": "CVE-2024-34707",
      "id": "CVE-2024-34707",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Nautobot\u0027s BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-34707.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T02:59:22.584Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3"
              },
              {
                "name": "https://github.com/nautobot/nautobot/pull/5697",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/nautobot/nautobot/pull/5697"
              },
              {
                "name": "https://github.com/nautobot/nautobot/pull/5698",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/nautobot/nautobot/pull/5698"
              },
              {
                "name": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c"
              },
              {
                "name": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-34707",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-15T15:20:33.233925Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-15T15:20:46.066Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "nautobot",
              "vendor": "nautobot",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.6.22"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.0.0, \u003c 2.2.4"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-05-13T19:22:41.202Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3"
            },
            {
              "name": "https://github.com/nautobot/nautobot/pull/5697",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nautobot/nautobot/pull/5697"
            },
            {
              "name": "https://github.com/nautobot/nautobot/pull/5698",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nautobot/nautobot/pull/5698"
            },
            {
              "name": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c"
            },
            {
              "name": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423"
            }
          ],
          "source": {
            "advisory": "GHSA-r2hr-4v48-fjv3",
            "discovery": "UNKNOWN"
          },
          "title": "Nautobot\u0027s BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2024-34707",
        "datePublished": "2024-05-13T19:22:41.202Z",
        "dateReserved": "2024-05-07T13:53:00.133Z",
        "dateUpdated": "2024-08-02T02:59:22.584Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-34707

Vulnerability from fkie_nvd - Published: 2024-05-14 15:39 - Updated: 2026-06-17 07:33

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L
4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c	Patch
security-advisories@github.com	https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423	Patch
security-advisories@github.com	https://github.com/nautobot/nautobot/pull/5697	Exploit, Patch
security-advisories@github.com	https://github.com/nautobot/nautobot/pull/5698	Exploit, Patch
security-advisories@github.com	https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/nautobot/nautobot/pull/5697	Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/nautobot/nautobot/pull/5698	Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3	Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	networktocode	nautobot	*
	networktocode	nautobot	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "nautobot",
          "vendor": "nautobot",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.2.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "874653B2-E8A9-468F-83FB-62C55FAAD853",
              "versionEndExcluding": "1.6.22",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE1E130B-18D5-4A29-949D-549103B3AC12",
              "versionEndExcluding": "2.2.4",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4."
    },
    {
      "lang": "es",
      "value": "Nautobot es una plataforma de automatizaci\u00f3n de redes y fuente de verdad de red. Un usuario de Nautobot con privilegios de administrador puede modificar los ajustes de configuraci\u00f3n `BANNER_TOP`, `BANNER_BOTTOM` y `BANNER_LOGIN` a trav\u00e9s del endpoint `/admin/constance/config/`. Normalmente, estas configuraciones se usan para proporcionar texto de banner personalizado en la parte superior e inferior de todas las p\u00e1ginas web de Nautobot (o espec\u00edficamente en la p\u00e1gina de inicio de sesi\u00f3n en el caso de `BANNER_LOGIN`), pero se inform\u00f3 que un usuario administrador puede hacer uso de estas configuraciones para inyectar HTML arbitrario, exponiendo potencialmente a los usuarios de Nautobot a problemas de seguridad como Cross Site Scripting (XSS almacenados). La vulnerabilidad est\u00e1 solucionada en Nautobot 1.6.22 y 2.2.4."
    }
  ],
  "id": "CVE-2024-34707",
  "lastModified": "2026-06-17T07:33:54.840",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 5.3,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-34707",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-05-15T15:20:33.233925Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-05-14T15:39:30.633",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/nautobot/nautobot/pull/5697"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/nautobot/nautobot/pull/5698"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/nautobot/nautobot/pull/5697"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/nautobot/nautobot/pull/5698"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-R2HR-4V48-FJV3

Vulnerability from github – Published: 2024-05-13 19:59 – Updated: 2024-05-14 20:04

Summary

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

Details

Impact

A Nautobot user with admin privileges can modify the BANNER_TOP, BANNER_BOTTOM, and BANNER_LOGIN configuration settings via the /admin/constance/config/ endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of BANNER_LOGIN) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS).

Patches

Has the problem been patched? What versions should users upgrade to?

Patches will be released as part of Nautobot 1.6.22 and 2.2.4.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

As described in the Nautobot documentation, these settings are only configurable through the admin UI of Nautobot if they are not explicitly set to some non-empty value in the nautobot_config.py or equivalent Nautobot configuration file. Therefore, adding the following configuration to said file completely mitigates this vulnerability in both Nautobot 1.x and 2.x:

BANNER_LOGIN = " "
BANNER_TOP = " "
BANNER_BOTTOM = " "

or alternately (Nautobot 2.x only), if those variables are not defined explicitly in your configuration file, setting the following environment variables for the Nautobot user account serves the same purpose:

NAUTOBOT_BANNER_LOGIN=" "
NAUTOBOT_BANNER_TOP=" "
NAUTOBOT_BANNER_BOTTOM=" "

Limiting all users who do not need elevated privileges to non-admin access (is_superuser: False and is_staff: False) is a partial mitigation as well.

References

https://github.com/nautobot/nautobot/pull/5697
https://github.com/nautobot/nautobot/pull/5698

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nautobot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nautobot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-34707"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-13T19:59:26Z",
    "nvd_published_at": "2024-05-14T15:39:30Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nPatches will be released as part of Nautobot 1.6.22 and 2.2.4.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nAs [described in the Nautobot documentation](https://docs.nautobot.com/projects/core/en/stable/user-guide/administration/configuration/optional-settings/#administratively-configurable-settings), these settings are only configurable through the admin UI of Nautobot if they are *not* explicitly set to some non-empty value in the `nautobot_config.py` or equivalent Nautobot configuration file. Therefore, adding the following configuration to said file completely mitigates this vulnerability in both Nautobot 1.x and 2.x:\n\n```python\nBANNER_LOGIN = \" \"\nBANNER_TOP = \" \"\nBANNER_BOTTOM = \" \"\n```\n\nor alternately (Nautobot 2.x only), if those variables are not defined explicitly in your configuration file, setting the following environment variables for the Nautobot user account serves the same purpose:\n\n```shell\nNAUTOBOT_BANNER_LOGIN=\" \"\nNAUTOBOT_BANNER_TOP=\" \"\nNAUTOBOT_BANNER_BOTTOM=\" \"\n```\n\nLimiting all users who do not need elevated privileges to non-admin access (`is_superuser: False` and `is_staff: False`) is a partial mitigation as well.\n\n\n### References\n\n- https://github.com/nautobot/nautobot/pull/5697\n- https://github.com/nautobot/nautobot/pull/5698",
  "id": "GHSA-r2hr-4v48-fjv3",
  "modified": "2024-05-14T20:04:15Z",
  "published": "2024-05-13T19:59:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34707"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/pull/5697"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/pull/5698"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nautobot/nautobot"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nautobot\u0027s BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages"
}

PYSEC-2026-1688

Vulnerability from pysec - Published: 2026-07-07 11:45 - Updated: 2026-07-07 17:24

Details

Impact

Patches

Has the problem been patched? What versions should users upgrade to?

Patches will be released as part of Nautobot 1.6.22 and 2.2.4.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

BANNER_LOGIN = " "
BANNER_TOP = " "
BANNER_BOTTOM = " "

NAUTOBOT_BANNER_LOGIN=" "
NAUTOBOT_BANNER_TOP=" "
NAUTOBOT_BANNER_BOTTOM=" "

Limiting all users who do not need elevated privileges to non-admin access (is_superuser: False and is_staff: False) is a partial mitigation as well.

References

https://github.com/nautobot/nautobot/pull/5697
https://github.com/nautobot/nautobot/pull/5698

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L

Impacted products

Name	purl
nautobot	pkg:pypi/nautobot

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nautobot",
        "purl": "pkg:pypi/nautobot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.22"
            },
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0",
        "1.0.0a1",
        "1.0.0a2",
        "1.0.0b1",
        "1.0.0b2",
        "1.0.0b3",
        "1.0.0b4",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.1.0",
        "1.1.1",
        "1.1.2",
        "1.1.3",
        "1.1.4",
        "1.1.5",
        "1.1.6",
        "1.2.0",
        "1.2.1",
        "1.2.10",
        "1.2.11",
        "1.2.2",
        "1.2.3",
        "1.2.4",
        "1.2.5",
        "1.2.6",
        "1.2.7",
        "1.2.8",
        "1.2.9",
        "1.3.0",
        "1.3.1",
        "1.3.10",
        "1.3.2",
        "1.3.3",
        "1.3.4",
        "1.3.5",
        "1.3.6",
        "1.3.7",
        "1.3.8",
        "1.3.9",
        "1.4.0",
        "1.4.1",
        "1.4.10",
        "1.4.2",
        "1.4.3",
        "1.4.4",
        "1.4.5",
        "1.4.7",
        "1.4.8",
        "1.4.9",
        "1.5.0",
        "1.5.1",
        "1.5.10",
        "1.5.11",
        "1.5.12",
        "1.5.13",
        "1.5.14",
        "1.5.15",
        "1.5.16",
        "1.5.17",
        "1.5.18",
        "1.5.19",
        "1.5.2",
        "1.5.20",
        "1.5.21",
        "1.5.22",
        "1.5.23",
        "1.5.24",
        "1.5.3",
        "1.5.4",
        "1.5.5",
        "1.5.6",
        "1.5.7",
        "1.5.8",
        "1.5.9",
        "1.6.0",
        "1.6.1",
        "1.6.10",
        "1.6.11",
        "1.6.12",
        "1.6.13",
        "1.6.14",
        "1.6.15",
        "1.6.16",
        "1.6.17",
        "1.6.18",
        "1.6.19",
        "1.6.2",
        "1.6.20",
        "1.6.21",
        "1.6.3",
        "1.6.4",
        "1.6.5",
        "1.6.6",
        "1.6.7",
        "1.6.8",
        "1.6.9",
        "2.0.0",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.0.4",
        "2.0.5",
        "2.0.6",
        "2.1.0",
        "2.1.0b1",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "2.1.4",
        "2.1.5",
        "2.1.6",
        "2.1.7",
        "2.1.8",
        "2.1.9",
        "2.2.0",
        "2.2.0b1",
        "2.2.1",
        "2.2.2",
        "2.2.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-34707",
    "GHSA-r2hr-4v48-fjv3"
  ],
  "details": "### Impact\n\nA Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nPatches will be released as part of Nautobot 1.6.22 and 2.2.4.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nAs [described in the Nautobot documentation](https://docs.nautobot.com/projects/core/en/stable/user-guide/administration/configuration/optional-settings/#administratively-configurable-settings), these settings are only configurable through the admin UI of Nautobot if they are *not* explicitly set to some non-empty value in the `nautobot_config.py` or equivalent Nautobot configuration file. Therefore, adding the following configuration to said file completely mitigates this vulnerability in both Nautobot 1.x and 2.x:\n\n```python\nBANNER_LOGIN = \" \"\nBANNER_TOP = \" \"\nBANNER_BOTTOM = \" \"\n```\n\nor alternately (Nautobot 2.x only), if those variables are not defined explicitly in your configuration file, setting the following environment variables for the Nautobot user account serves the same purpose:\n\n```shell\nNAUTOBOT_BANNER_LOGIN=\" \"\nNAUTOBOT_BANNER_TOP=\" \"\nNAUTOBOT_BANNER_BOTTOM=\" \"\n```\n\nLimiting all users who do not need elevated privileges to non-admin access (`is_superuser: False` and `is_staff: False`) is a partial mitigation as well.\n\n\n### References\n\n- https://github.com/nautobot/nautobot/pull/5697\n- https://github.com/nautobot/nautobot/pull/5698",
  "id": "PYSEC-2026-1688",
  "modified": "2026-07-07T17:24:47.695986Z",
  "published": "2026-07-07T11:45:42.267288Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34707"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/pull/5697"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/pull/5698"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nautobot/nautobot"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/nautobot"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-r2hr-4v48-fjv3"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nautobot\u0027s BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-34707 (GCVE-0-2024-34707)

FKIE_CVE-2024-34707

GHSA-R2HR-4V48-FJV3

Impact

Patches

Workarounds

References

PYSEC-2026-1688

Impact

Patches

Workarounds

References

Tags

Sightings

Nomenclature

Related by attack behaviour