Lookup for vulnerable packages by Package URL.
| Purl | pkg:pypi/nautobot@2.0.6 |
|---|
| Type | pypi |
|---|
| Namespace | |
|---|
| Name | nautobot |
|---|
| Version | 2.0.6 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 2.4.10 |
|---|
| Latest_non_vulnerable_version | 2.4.10 |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-d3uz-p963-6fay |
| vulnerability_id |
VCID-d3uz-p963-6fay |
| summary |
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-23345, GHSA-v4xv-795h-rv4h, PYSEC-2024-16
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-d3uz-p963-6fay |
|
| 1 |
| url |
VCID-kjkb-625k-kudt |
| vulnerability_id |
VCID-kjkb-625k-kudt |
| summary |
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0 |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-51649, GHSA-vf5m-xrhm-v999, PYSEC-2023-287
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kjkb-625k-kudt |
|
| 2 |
| url |
VCID-vr34-ms8k-zybv |
| vulnerability_id |
VCID-vr34-ms8k-zybv |
| summary |
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-49142, GHSA-wjw6-95h5-4jpx, PYSEC-2025-74, PYSEC-2025-79
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vr34-ms8k-zybv |
|
| 3 |
| url |
VCID-z4ux-pgu6-6kc9 |
| vulnerability_id |
VCID-z4ux-pgu6-6kc9 |
| summary |
Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI view (`/extras/dynamic-groups/<uuid>/`) and/or the members REST API view (`/api/extras/dynamic-groups/<uuid>/members/`) to list the objects that are members of a given Dynamic Group. In versions of Nautobot between 1.3.0 (where the Dynamic Groups feature was added) and 1.6.22 inclusive, and 2.0.0 through 2.2.4 inclusive, Nautobot fails to restrict these listings based on the member object permissions - for example a Dynamic Group of Device objects will list all Devices that it contains, regardless of the user's `dcim.view_device` permissions or lack thereof. This issue has been fixed in Nautobot versions 1.6.23 and 2.2.5. Users are advised to upgrade. This vulnerability can be partially mitigated by removing `extras.view_dynamicgroup` permission from users however a full fix will require upgrading. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-36112, PYSEC-2024-166
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-z4ux-pgu6-6kc9 |
|
|
|---|
| Fixing_vulnerabilities |
| 0 |
| url |
VCID-qbp5-ry2r-hufh |
| vulnerability_id |
VCID-qbp5-ry2r-hufh |
| summary |
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs `/files/get/?name=...` and `/files/download/?name=...` are used to provide admin access to files that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these files are ephemeral and are deleted once the Job in question runs.
In the default implementation used in Nautobot, as provided by `django-db-file-storage`, these URLs do not by default require any user authentication to access; they should instead be restricted to only users who have permissions to view Nautobot's `FileProxy` model instances.
Note that no URL mechanism is provided for listing or traversal of the available file `name` values, so in practice an unauthenticated user would have to guess names to discover arbitrary files for download, but if a user knows the file name/path value, they can access it without authenticating, so we are considering this a vulnerability.
Fixes are included in Nautobot 1.6.7 and Nautobot 2.0.6. No known workarounds are available other than applying the patches included in those versions. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-50263, GHSA-75mc-3pjc-727q, PYSEC-2023-286
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qbp5-ry2r-hufh |
|
|
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:pypi/nautobot@2.0.6 |
|---|