SB2023102472 - Exposure of Private Information ('Privacy Violation') in Nautobot

Description

This security bulletin contains information about 1 vulnerability.

1) Exposure of Private Information ('Privacy Violation') (CVE-ID: CVE-2023-46128)

CWE-ID: CWE-359 - Exposure of Private Information ('Privacy Violation')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose hashed user passwords.

The vulnerability exists due to exposure of private personal information in REST API endpoints with nested User object references when processing requests with the ?depth= query parameter. A remote user can send a request to an affected endpoint with an appropriate ?depth= value to disclose hashed user passwords.

The passwords are exposed as stored in the database and are not disclosed in plaintext. Direct access to the /api/users/users/ endpoint does not expose this field, but nested user data in affected core or plugin REST API endpoints may do so.

Remediation

Install update from vendor's website.

References

• https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hw-74xv-4gqp
• https://github.com/nautobot/nautobot/pull/4692