Information disclosure in Nautobot
CVE-2023-46128
Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the `?depth=<N>` query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (43.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 43.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Nautobot — versions >= 2.0.0, < 2.0.3
- Networktocode Nautobot
Weakness classification (CWE)
References
- github.com/nautobot/nautobot/security/advisories/GHSA-r2hw-74xv-4gqp (Exploit, Patch, Vendor Advisory)
- github.com/nautobot/nautobot/pull/4692 (Patch)
- github.com/nautobot/nautobot/commit/1ce8e5c658a075c29554d517cd453675e5d40d71 (Patch)
Frequently asked questions
- What is CVE-2023-46128?
- CVE-2023-46128 is a medium-severity vulnerability in Nautobot, classified under Information Disclosure. CVSS score: 6.5/10. Published 2023-10-25.
- How severe is CVE-2023-46128?
- Medium severity. CVSS v3 base score is 6.5 out of 10.