ByteOS Network

NVD Vulnerability Details :

CVE-2024-32979

Analyzed

Source-security-advisories@github.com

Published At-01 May, 2024 | 11:15

Updated At-26 Aug, 2025 | 18:54

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot versions 1.6.20 and 2.2.3. There are no known workarounds for this vulnerability.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CPE Matches

networktocode>>nautobot>>Versions from 1.5.0(inclusive) to 1.6.20(exclusive)

cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*

networktocode>>nautobot>>Versions from 2.0.0(inclusive) to 2.2.3(exclusive)

cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e	security-advisories@github.com	Patch
https://github.com/nautobot/nautobot/pull/5646	security-advisories@github.com	Patch
https://github.com/nautobot/nautobot/pull/5647	security-advisories@github.com	Patch
https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg	security-advisories@github.com	Third Party Advisory
https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e	af854a3a-2127-422b-91ae-364da2661108	Patch
https://github.com/nautobot/nautobot/pull/5646	af854a3a-2127-422b-91ae-364da2661108	Patch
https://github.com/nautobot/nautobot/pull/5647	af854a3a-2127-422b-91ae-364da2661108	Patch
https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History