ByteOS Network

NVD Vulnerability Details :

CVE-2024-34707

Analyzed

Source-security-advisories@github.com

Published At-14 May, 2024 | 15:39

Updated At-26 Aug, 2025 | 16:16

Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L
Primary	3.1	4.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CPE Matches

networktocode>>nautobot>>Versions before 1.6.22(exclusive)

cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*

networktocode>>nautobot>>Versions from 2.0.0(inclusive) to 2.2.4(exclusive)

cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c	security-advisories@github.com	Patch
https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423	security-advisories@github.com	Patch
https://github.com/nautobot/nautobot/pull/5697	security-advisories@github.com	Exploit Patch
https://github.com/nautobot/nautobot/pull/5698	security-advisories@github.com	Exploit Patch
https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3	security-advisories@github.com	Patch Vendor Advisory
https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51c	af854a3a-2127-422b-91ae-364da2661108	Patch
https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423	af854a3a-2127-422b-91ae-364da2661108	Patch
https://github.com/nautobot/nautobot/pull/5697	af854a3a-2127-422b-91ae-364da2661108	Exploit Patch
https://github.com/nautobot/nautobot/pull/5698	af854a3a-2127-422b-91ae-364da2661108	Exploit Patch
https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History