Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/38394?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/38394?format=api", "purl": "pkg:pypi/nautobot@2.1.0", "type": "pypi", "namespace": "", "name": "nautobot", "version": "2.1.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "2.4.10", "latest_non_vulnerable_version": "2.4.10", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36691?format=api", "vulnerability_id": "VCID-d3uz-p963-6fay", "summary": "Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.", "references": [ { "reference_url": "https://github.com/nautobot/nautobot/commit/17effcbe84a72150c82b138565c311bbee357e80", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "url": "https://github.com/nautobot/nautobot/commit/17effcbe84a72150c82b138565c311bbee357e80" }, { "reference_url": "https://github.com/nautobot/nautobot/commit/64312a4297b5ca49b6cdedf477e41e8e4fd61cce", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "url": "https://github.com/nautobot/nautobot/commit/64312a4297b5ca49b6cdedf477e41e8e4fd61cce" }, { "reference_url": "https://github.com/nautobot/nautobot/pull/5133", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "url": "https://github.com/nautobot/nautobot/pull/5133" }, { "reference_url": "https://github.com/nautobot/nautobot/pull/5134", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "url": "https://github.com/nautobot/nautobot/pull/5134" }, { "reference_url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-v4xv-795h-rv4h", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-v4xv-795h-rv4h" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23345", "reference_id": "CVE-2024-23345", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23345" }, { "reference_url": "https://github.com/advisories/GHSA-v4xv-795h-rv4h", "reference_id": "GHSA-v4xv-795h-rv4h", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-v4xv-795h-rv4h" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/39129?format=api", "purl": "pkg:pypi/nautobot@2.1.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-vr34-ms8k-zybv" }, { "vulnerability": "VCID-z4ux-pgu6-6kc9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/nautobot@2.1.2" } ], "aliases": [ "CVE-2024-23345", "GHSA-v4xv-795h-rv4h", "PYSEC-2024-16" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-d3uz-p963-6fay" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37079?format=api", "vulnerability_id": "VCID-vr34-ms8k-zybv", "summary": "Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N" } ], "url": "https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description" }, { "reference_url": "https://github.com/nautobot/nautobot/pull/7417", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N" } ], "url": "https://github.com/nautobot/nautobot/pull/7417" }, { "reference_url": "https://github.com/nautobot/nautobot/pull/7429", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N" } ], "url": "https://github.com/nautobot/nautobot/pull/7429" }, { "reference_url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wjw6-95h5-4jpx", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N" } ], "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wjw6-95h5-4jpx" }, { "reference_url": "https://jinja.palletsprojects.com/en/stable/sandbox", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N" } ], "url": "https://jinja.palletsprojects.com/en/stable/sandbox" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/45354?format=api", "purl": "pkg:pypi/nautobot@2.4.10", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/nautobot@2.4.10" } ], "aliases": [ "CVE-2025-49142", "GHSA-wjw6-95h5-4jpx", "PYSEC-2025-74", "PYSEC-2025-79" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vr34-ms8k-zybv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36797?format=api", "vulnerability_id": "VCID-z4ux-pgu6-6kc9", "summary": "Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI view (`/extras/dynamic-groups/<uuid>/`) and/or the members REST API view (`/api/extras/dynamic-groups/<uuid>/members/`) to list the objects that are members of a given Dynamic Group. In versions of Nautobot between 1.3.0 (where the Dynamic Groups feature was added) and 1.6.22 inclusive, and 2.0.0 through 2.2.4 inclusive, Nautobot fails to restrict these listings based on the member object permissions - for example a Dynamic Group of Device objects will list all Devices that it contains, regardless of the user's `dcim.view_device` permissions or lack thereof. This issue has been fixed in Nautobot versions 1.6.23 and 2.2.5. Users are advised to upgrade. This vulnerability can be partially mitigated by removing `extras.view_dynamicgroup` permission from users however a full fix will require upgrading.", "references": [ { "reference_url": "https://github.com/nautobot/nautobot/pull/5757", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/nautobot/nautobot/pull/5757" }, { "reference_url": "https://github.com/nautobot/nautobot/pull/5762", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/nautobot/nautobot/pull/5762" }, { "reference_url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-qmjf-wc2h-6x3q", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-qmjf-wc2h-6x3q" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/41187?format=api", "purl": "pkg:pypi/nautobot@2.3.0b1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-vr34-ms8k-zybv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/nautobot@2.3.0b1" } ], "aliases": [ "CVE-2024-36112", "PYSEC-2024-166" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-z4ux-pgu6-6kc9" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36654?format=api", "vulnerability_id": "VCID-kjkb-625k-kudt", "summary": "Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0", "references": [ { "reference_url": "https://github.com/nautobot/nautobot", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/nautobot/nautobot" }, { "reference_url": "https://github.com/nautobot/nautobot/commit/3d964f996f4926126c1d7853ca87b2ff475997a2", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/nautobot/nautobot/commit/3d964f996f4926126c1d7853ca87b2ff475997a2" }, { "reference_url": "https://github.com/nautobot/nautobot/commit/d33d0c15a36948c45244e5b5e10bc79b8e62de7f", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/nautobot/nautobot/commit/d33d0c15a36948c45244e5b5e10bc79b8e62de7f" }, { "reference_url": "https://github.com/nautobot/nautobot/issues/4988", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://github.com/nautobot/nautobot/issues/4988" }, { "reference_url": "https://github.com/nautobot/nautobot/pull/4993", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://github.com/nautobot/nautobot/pull/4993" }, { "reference_url": "https://github.com/nautobot/nautobot/pull/4995", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://github.com/nautobot/nautobot/pull/4995" }, { "reference_url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-vf5m-xrhm-v999", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-vf5m-xrhm-v999" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2023-287.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2023-287.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51649", "reference_id": "CVE-2023-51649", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51649" }, { "reference_url": "https://github.com/advisories/GHSA-vf5m-xrhm-v999", "reference_id": "GHSA-vf5m-xrhm-v999", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-vf5m-xrhm-v999" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/38395?format=api", "purl": "pkg:pypi/nautobot@1.6.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-d3uz-p963-6fay" }, { "vulnerability": "VCID-vr34-ms8k-zybv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/nautobot@1.6.8" }, { "url": "http://public2.vulnerablecode.io/api/packages/38394?format=api", "purl": "pkg:pypi/nautobot@2.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-d3uz-p963-6fay" }, { "vulnerability": "VCID-vr34-ms8k-zybv" }, { "vulnerability": "VCID-z4ux-pgu6-6kc9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/nautobot@2.1.0" } ], "aliases": [ "CVE-2023-51649", "GHSA-vf5m-xrhm-v999", "PYSEC-2023-287" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kjkb-625k-kudt" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/nautobot@2.1.0" }