PT-2025-26761 · Netbox · Netbox

Published 2025-06-24 · Updated 2025-06-30 · CVE-2024-56916

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Netbox Community version 4.1.7

Description: In Netbox Community, once authenticated, the Configuration History > Add option is vulnerable to cross-site scripting (XSS) due to the current value field rendering user-supplied HTML. An authenticated attacker can leverage this to add malicious JavaScript to the any banner field. Once a victim edits a Configuration History version or attempts to add a new version, the XSS payload will trigger.

Recommendations: For Netbox Community version 4.1.7, as a temporary workaround, consider disabling the current value field in the Configuration History > Add option until a patch is available. Restrict access to the Configuration History feature to minimize the risk of exploitation. Avoid using the any banner field in the affected Configuration History version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56916

Affected Products

Netbox

References · 9

• 🔥 https://github.com/noxlumens/Vulnerability-Research/tree/main/CVE-2024-56916 · Exploit
• 🔥 https://youtube.com/watch?v=GC8-PUlu2i8 · Exploit
• https://osv.dev/vulnerability/CVE-2024-56916 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56916 · Security Note
• https://github.com/netbox-community/netbox/releases/tag/v4.1.7 · Note
• https://t.me/cvetracker/26963 · Telegram Post
• https://twitter.com/CVEnew/status/1937569675715416168 · Twitter Post
• https://t.me/cvenotify/127116 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1937603834185982458 · Twitter Post