Cross-Site Scripting Vulnerability in Nautobot Network Automation Platform
CVE-2024-34707
Currently unrated
What is CVE-2024-34707?
A vulnerability in the Nautobot Network Automation Platform allows an authenticated admin user to modify specific configuration settings through the /admin/constance/config/ endpoint. By leveraging the BANNER_TOP, BANNER_BOTTOM, and BANNER_LOGIN settings, an attacker can inject arbitrary HTML into the application. This opens the door to potential cross-site scripting (XSS) attacks, which could compromise user data and session integrity. The issue was addressed in Nautobot versions 1.6.22 and 2.2.4.