CVE-2024-34707CWE-79

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

High · published May 13, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00606 · 48.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-05-13T19:22Z
EPSS history
Timeline
  • 13 MAY 19:22Z
    Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
    cvelistv5