Exposure of Sensitive Information to an Unauthorized Actor Affecting nautobot package, versions [1.1.0,1.6.7) [2.0.0,2.0.6)


Severity

0.0
low
0
10

    Threat Intelligence

    EPSS
    0.07% (32nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-NAUTOBOT-6124757
  • published 13 Dec 2023
  • disclosed 12 Dec 2023
  • credit Kircheneer

How to fix?

Upgrade nautobot to version 1.6.7, 2.0.6 or higher.

Overview

nautobot is a Source of truth and network automation platform.

Affected versions of this package are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor via the URLs /files/get/?name=... and /files/download/?name=..., which are intended to provide admin access to uploaded files associated with Job run requests. An attacker can access sensitive files without authentication by knowing the file name/path value.

CVSS Scores

version 3.1
Expand this section

Snyk

3.7 low
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    None
  • Availability (A)
    None
Expand this section

NVD

5.3 medium