PT-2023-7024 · Nautobot · Nautobot

Glennnmatthews · Publicado 2023-10-24 · Atualizado 2023-11-01 · CVE-2023-46128

Positive Technologies (AI Summary)

CVSS v4.0

8.3

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nautobot versions 2.0.0 through 2.0.2

Description The issue concerns the exposure of hashed user passwords in Nautobot's REST API endpoints when the ?depth=<N> query parameter is used. This affects any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. Known impacted endpoints include /api/dcim/rack-reservations/, /api/extras/job-results/, /api/extras/notes/, /api/extras/object-changes/, /api/extras/scheduled-jobs/, and /api/users/permissions/, among others, when an appropriate ?depth=<N> query parameter is specified.

Recommendations To resolve the issue, upgrade to Nautobot version 2.0.3 or later. As a temporary workaround, consider restricting access to the impacted REST API endpoints, although this is not recommended as other endpoints may also expose this issue until patched.

Exploit

Correção

Cleartext Storage of Sensitive Information

Information Disclosure

Enumeração de Fraquezas

CWE-312

CWE-200

CWE-359

Identificadores relacionados

BDU:2023-08045

CVE-2023-46128

GHSA-R2HW-74XV-4GQP

PYSEC-2023-220

Produtos afetados

Nautobot

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46128.json · Exploit
• 🔥 https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hw-74xv-4gqp · Exploit
• https://github.com/nautobot/nautobot · Nota
• https://github.com/nautobot/nautobot/pull/4692 · Correção
• https://github.com/nautobot/nautobot/commit/1ce8e5c658a075c29554d517cd453675e5d40d71 · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2023-220.yaml · Nota
• https://osv.dev/vulnerability/GHSA-r2hw-74xv-4gqp · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-220 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-46128 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-46128 · Nota de Segurança
• https://twitter.com/CVEnew/status/1716826906509946918 · Publicação no Twitter
• https://t.me/latest_high_impact_cve/48 · Publicação no Telegram
• https://t.me/cibsecurity/72863 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-08045 · Nota de Segurança