CVE-2024-29199
A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users.
Does this matter?
Lower severity and a low EPSS score (0.63%). Track it; it rarely justifies an emergency change on its own.
Description
Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.63% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- networktocode/nautobot
- Source
- security-advisories@github.com
References
- https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750Patch
- https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfbPatch
- https://github.com/nautobot/nautobot/pull/5464Patch
- https://github.com/nautobot/nautobot/pull/5465Patch
- https://github.com/nautobot/nautobot/releases/tag/v1.6.16Release Notes
- https://github.com/nautobot/nautobot/releases/tag/v2.1.9Release Notes
- https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4Third Party Advisory
- https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750Patch
- https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfbPatch
- https://github.com/nautobot/nautobot/pull/5464Patch
- https://github.com/nautobot/nautobot/pull/5465Patch
- https://github.com/nautobot/nautobot/releases/tag/v1.6.16Release Notes
- https://github.com/nautobot/nautobot/releases/tag/v2.1.9Release Notes
- https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.