CVE-2024-32979 json
Reflected Cross-site Scripting potential in all object list views in Nautobot
published 2y ago modified 2mo ago also EUVD-2024-1679 , GHSA-jxgr-gcj5-cqqg , PYSEC-2026-1686
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot versions 1.6.20 and 2.2.3. There are no known workarounds for this vulnerability.
Patch / fix
- pypi nautobot 1.6.20, 2.2.3
- networktocode nautobot 1.6.20
- github.com/nautobot/nautobot@42440eb commit
- github.com/nautobot/nautobot@2ea5797 commit
- github.com/nautobot/nautobot#5646 pull request
- github.com/nautobot/nautobot#5647 pull request
- github.com/nautobot/nautobot/releases/tag/v1.6.20 release
- github.com/nautobot/nautobot/releases/tag/v2.2.3 release
Is CVE-2024-32979 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | nautobot | >=1.5.0, <1.6.20 >=2.0.0, <2.2.3 |
1.6.20 2.2.3 |
Affected products
- nautobot nautobot
- networktocode nautobot
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/nautobot/nautobot/pull/5646
web, patch
-
github.com
/nautobot/nautobot/pull/5647
web, patch
-
github.com
/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e
web, patch
-
github.com
/nautobot/nautobot/commit/2ea5797ea43646d5d8b29433e4c707b5a9758146
web
-
github.com
/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-32979
advisory
-
github.com
/nautobot/nautobot
package
-
github.com
/nautobot/nautobot/releases/tag/v1.6.20
web
-
github.com
/nautobot/nautobot/releases/tag/v2.2.3
web
-
pypi.org
/project/nautobot
package
-
github.com
/advisories/GHSA-jxgr-gcj5-cqqg
advisory
Sources
- CVE List CVE-2024-32979
- GitHub Advisory GHSA-jxgr-gcj5-cqqg
- NVD CVE-2024-32979
- OSV PYSEC-2026-1686
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.