Vulnerabilities > CVE-2023-51649 - Unspecified vulnerability in Networktocode Nautobot

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

networktocode

NVD

Published: 2023-12-22

Updated: 2024-11-21

Summary

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0

Vulnerable Configurations

Part	Description	Count
Application	Networktocode Networktocode Nautobot 2.0.0 Networktocode Nautobot 2.0.1 Networktocode Nautobot 2.0.2 Networktocode Nautobot 2.0.3 Networktocode Nautobot 2.0.4 Networktocode Nautobot 2.0.5 Networktocode Nautobot 2.0.6 Networktocode Nautobot 1.5.14 Networktocode Nautobot 1.5.15 Networktocode Nautobot 1.5.16 Networktocode Nautobot 1.5.17 Networktocode Nautobot 1.5.18 Networktocode Nautobot 1.5.19 Networktocode Nautobot 1.5.20 Networktocode Nautobot 1.5.21 Networktocode Nautobot 1.5.22 Networktocode Nautobot 1.5.23 Networktocode Nautobot 1.5.24 Networktocode Nautobot 1.6.0 Networktocode Nautobot 1.6.1 Networktocode Nautobot 1.6.2 Networktocode Nautobot 1.6.3 Networktocode Nautobot 1.6.4 Networktocode Nautobot 1.6.5 Networktocode Nautobot 1.6.6 Networktocode Nautobot 1.6.7	36

Summary

Vulnerable Configurations

References