CVE-2024-32979

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-32979
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32979.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-32979
Aliases
Published
2024-05-01T10:49:56.643Z
Modified
2026-07-08T08:12:42.808487494Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L CVSS Calculator
Summary
Reflected Cross-site Scripting potential in all object list views in Nautobot
Details

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot versions 1.6.20 and 2.2.3. There are no known workarounds for this vulnerability.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32979.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/nautobot/nautobot

Affected ranges

Type
GIT
Repo
https://github.com/nautobot/nautobot
Events
Introduced
9c1541f7a90b89f47c344dff3841d5200fca1efd
Fixed
0ab8c315649b8ba620e8860829d57ad9c7533a72
Introduced
3013f25b41a1409adb815afb654fad4988f640ef
Fixed
f30d16061c41c4b47d85381fdb620c1b1796bafc
Fixed
42440ebd9b381534ad89d62420ebea00d703d64e
Database specific 
{
    "cpe": "cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.5.0"
        },
        {
            "fixed": "1.6.20"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.2.3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32979.json"