SB2023112252 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Nautobot

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2023-48705)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to execute arbitrary script code in a victim's browser.

The vulnerability exists due to improper neutralization of script-related html tags in custom links, job buttons, and computed fields when rendering user-authored content. A remote user can create or edit crafted content to execute arbitrary script code in a victim's browser.

User interaction is required to render a page containing the crafted content.

Remediation

Install update from vendor's website.

References

• https://github.com/nautobot/nautobot/security/advisories/GHSA-cf9f-wmhp-v4pr
• https://github.com/nautobot/nautobot/pull/4832