GHSA-jxgr-gcj5-cqqg

Source

https://github.com/advisories/GHSA-jxgr-gcj5-cqqg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-jxgr-gcj5-cqqg/GHSA-jxgr-gcj5-cqqg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jxgr-gcj5-cqqg

Aliases

Published

2024-05-01T09:36:35Z

Modified

2026-09-10T03:50:13Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L CVSS Calculator

Summary

nautobot has reflected Cross-site Scripting potential in all object list views

Details

Impact

It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable, including:

/dcim/location-types/
/dcim/locations/
/dcim/racks/
/dcim/rack-groups/
/dcim/rack-reservations/
/dcim/rack-elevations/
/tenancy/tenants/
/tenancy/tenant-groups/
/extras/tags/
/extras/statuses/
/extras/roles/
/extras/dynamic-groups/
/dcim/devices/
/dcim/platforms/
/dcim/virtual-chassis/
/dcim/device-redundancy-groups/
/dcim/interface-redundancy-groups/
/dcim/device-types/
/dcim/manufacturers/
/dcim/cables/
/dcim/console-connections/
/dcim/power-connections/
/dcim/interface-connections/
/dcim/interfaces/
/dcim/front-ports/
/dcim/rear-ports/
/dcim/console-ports/
/dcim/console-server-ports/
/dcim/power-ports/
/dcim/power-outlets/
/dcim/device-bays/
/dcim/inventory-items/
/ipam/ip-addresses/
/ipam/prefixes
/ipam/rirs/
/ipam/namespaces/
/ipam/vrfs/
/ipam/route-targets/
/ipam/vlans/
/ipam/vlan-groups/
/ipam/services/
/virtualization/virtual-machines/
/virtualization/interfaces/
/virtualization/clusters/
/virtualization/cluster-types/
/virtualization/cluster-groups/
/circuits/circuits/
/circuits/circuit-types/
/circuits/providers/
/circuits/provider-networks/
/dcim/power-feeds/
/dcim/power-panels/
/extras/secrets/
/extras/secrets-groups/
/extras/jobs/
/extras/jobs/scheduled-jobs/approval-queue/
/extras/jobs/scheduled-jobs/
/extras/job-results/
/extras/job-hooks/
/extras/job-buttons/
/extras/object-changes/
/extras/git-repositories/
/extras/graphql-queries/
/extras/relationships/
/extras/notes/
/extras/config-contexts/
/extras/config-context-schemas/
/extras/export-templates/
/extras/external-integrations/
/extras/webhooks/
/extras/computed-fields/
/extras/custom-fields/
/extras/custom-links/

as well as any similar object-list views provided by any Nautobot App.

Patches

Fixed in Nautobot 1.6.20 and 2.2.3.

Workarounds

No workaround has been identified

References

#5646
#5647

Credit to Michael Panorios for reporting this issue.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-05-01T09:36:35Z",
    "nvd_published_at":  "2024-05-01T11:15:47Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / nautobot

Package

Name: nautobot; View open source insights on deps.dev
Purl: pkg:pypi/nautobot

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.5.0

Fixed

1.6.20

Affected versions

1.*

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.5.10

1.5.11

1.5.12

1.5.13

1.5.14

1.5.15

1.5.16

1.5.17

1.5.18

1.5.19

1.5.20

1.5.21

1.5.22

1.5.23

1.5.24

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.6.10

1.6.11

1.6.12

1.6.13

1.6.14

1.6.15

1.6.16

1.6.17

1.6.18

1.6.19

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-jxgr-gcj5-cqqg/GHSA-jxgr-gcj5-cqqg.json"

PyPI / nautobot

Package

Name: nautobot; View open source insights on deps.dev
Purl: pkg:pypi/nautobot

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.2.3

Affected versions

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.1.0b1

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.2.0b1

2.2.0

2.2.1

2.2.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-jxgr-gcj5-cqqg/GHSA-jxgr-gcj5-cqqg.json"