PT-2023-24499 · Netbox · Netbox

Kkthxbye-Code · Published 2023-05-24 · Updated 2024-08-02 · CVE-2023-33796

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Netbox version 3.5.1

Description A vulnerability allows unauthenticated attackers to execute queries against the GraphQL database, potentially granting them access to sensitive data stored in the database. However, the vendor disputes this, stating that the reporter's only query was for the schema of the API, which is public, and queries for database objects would have been denied.

Recommendations For Netbox version 3.5.1, consider restricting access to the GraphQL database to prevent potential exploitation, as the vendor disputes the vulnerability but it is still reported to potentially allow access to sensitive data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-33796

Affected Products

Netbox

References · 5

• 🔥 https://github.com/anhdq201/netbox/issues/16 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-33796 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33796 · Vendor Advisory
• https://github.com/netbox-community/netbox/discussions/12729#discussioncomment-6008669 · Note
• https://t.me/cvenotify/88576 · Telegram Post