Cross-site scripting in Nautobot - #VU162770

Vulnerability details

The vulnerability allows a low-privileged remote attacker to execute stored scripts in another user's authenticated Nautobot session.

The vulnerability exists due to unsafe rendering of Required Validation Rule custom error messages when users submit create or edit forms with a targeted field empty. A low-privileged remote attacker can use permission to add or change these rules to store malicious messages that execute with the victim's permissions, potentially including administrator privileges.

Affected software

Remediation

External References

• https://github.com/nautobot/nautobot/security/advisories/GHSA-mqq2-g399-v4mp

Related Security Bulletins

• Multiple vulnerabilities in Nautobot