CVE-2024-29199lowCWE-200

CVE-2024-29199: fallo de gravedad baja en nautobot

Unauthenticated views may expose information to anonymous users

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear nautobot+ Monitorear nautobot

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.7epss 0.6%
Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
nautobot · nautobot
CVEs relacionadas — nautobot

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-25657HIGHRemote code execution in Jinja2 template rendering in NautobotEPSS 1.5%CVE-2023-50263LOWNautobot allows unauthenticated db-file-storage viewsEPSS 0.7%CVE-2023-46128MEDIUMExposure of hashed user passwords via REST API in NautobotEPSS 0.7%CVE-2024-34707HIGHNautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pagesEPSS 0.6%CVE-2023-48705HIGHnautobot has XSS potential in custom links, job buttons, and computed fieldsEPSS 0.5%CVE-2024-32979HIGHReflected Cross-site Scripting potential in all object list views in NautobotEPSS 0.5%