CVE-2024-23345
- Source
- https://cve.org/CVERecord?id=CVE-2024-23345
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23345.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-23345
- Aliases
- Published
- 2024-01-22T23:14:52Z
- Modified
- 2026-08-24T03:46:24Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L CVSS Calculator
- Summary
- Nautobot has XSS potential in rendered Markdown fields
- Details
-
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23345.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23345.json
- https://github.com/nautobot/nautobot/security/advisories/GHSA-v4xv-795h-rv4h
- https://nvd.nist.gov/vuln/detail/CVE-2024-23345
- https://github.com/nautobot/nautobot/commit/17effcbe84a72150c82b138565c311bbee357e80
- https://github.com/nautobot/nautobot/commit/64312a4297b5ca49b6cdedf477e41e8e4fd61cce
- https://github.com/nautobot/nautobot/pull/5133
- https://github.com/nautobot/nautobot/pull/5134
Affected packages
Git / github.com/nautobot/nautobot
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nautobot/nautobot
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedFixedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "1.6.10" }, { "introduced": "2.0.0" }, { "fixed": "2.1.2" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }
Affected versions
v1.*
v1.0.0
v1.0.0a1
v1.0.0a2
v1.0.0b1
v1.0.0b2
v1.0.0b3
v1.0.0b4
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.0b1
v1.1.0b2
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.2
v1.2.0
v1.2.0b1
v1.2.1
v1.2.10
v1.2.11
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v1.3
v1.3.0
v1.3.1
v1.3.10
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.4.0
v1.4.1
v1.4.2
v1.6.0-rc.1
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.6.8
v1.6.9
v2.*
v2.0.0
v2.0.0-rc.3
v2.0.0-rc.4
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.1.0
v2.1.1