Cross-Site Scripting Vulnerability in Nautobot Network Automation Platform
CVE-2024-34707
Currently unrated
What is CVE-2024-34707?
A vulnerability in the Nautobot Network Automation Platform allows an authenticated admin user to modify specific configuration settings through the /admin/constance/config/ endpoint. By leveraging the BANNER_TOP, BANNER_BOTTOM, and BANNER_LOGIN settings, an attacker can inject arbitrary HTML into the application. This opens the door to potential cross-site scripting (XSS) attacks, which could compromise user data and session integrity. The issue was addressed in Nautobot versions 1.6.22 and 2.2.4.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.