Patchfirst
Patchfirst
ChainnautobotPyPI:nautobot

nautobot: related fixes (2023–2024)

7 CVEs over 3 generations, 24 Oct 2023 to 28 May 2024.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2023-4612824 Oct 2023 First in the chain
  2. CVE-2023-4870522 Nov 2023 next fix after CVE-2023-46128
  3. CVE-2023-5026312 Dec 2023 next fix after CVE-2023-48705
  4. CVE-2023-5164922 Dec 2023 related to CVE-2023-48705next fix after CVE-2023-50263
  5. CVE-2024-2334522 Jan 2024 related to CVE-2023-48705next fix after CVE-2023-51649
  6. CVE-2024-2919926 Mar 2024 next fix after CVE-2024-23345related to CVE-2023-46128and 2 more
  7. CVE-2024-3611228 May 2024 related to CVE-2024-29199
Oct 2023DecJan 2024FebMarAprMay CVE-2024-23345 → CVE-2024-29199: Next fix in the same package (high confidence)CVE-2023-46128 → CVE-2024-29199: related (medium confidence)CVE-2023-48705 → CVE-2023-51649: related (medium confidence)CVE-2023-48705 → CVE-2024-23345: related (medium confidence)CVE-2023-48705 → CVE-2024-29199: related (medium confidence)CVE-2023-50263 → CVE-2024-29199: related (medium confidence)CVE-2024-29199 → CVE-2024-36112: related (medium confidence)CVE-2023-46128 → CVE-2023-48705: Next fix in the same package (low confidence)CVE-2023-48705 → CVE-2023-50263: Next fix in the same package (low confidence)CVE-2023-50263 → CVE-2023-51649: Next fix in the same package (low confidence)CVE-2023-51649 → CVE-2024-23345: Next fix in the same package (low confidence) CVE-2023-46128 24 Oct 2023 CVE-2023-48705 22 Nov 2023 CVE-2023-50263 12 Dec 2023 CVE-2023-51649 22 Dec 2023 CVE-2024-23345 22 Jan 2024 CVE-2024-29199 26 Mar 2024 CVE-2024-36112 28 May 2024 Oct 2023NovDecJan 2024FebMarAprMay CVE-2024-23345 → CVE-2024-29199: Next fix in the same package (high confidence)CVE-2023-46128 → CVE-2024-29199: related (medium confidence)CVE-2023-48705 → CVE-2023-51649: related (medium confidence)CVE-2023-48705 → CVE-2024-23345: related (medium confidence)CVE-2023-48705 → CVE-2024-29199: related (medium confidence)CVE-2023-50263 → CVE-2024-29199: related (medium confidence)CVE-2024-29199 → CVE-2024-36112: related (medium confidence)CVE-2023-46128 → CVE-2023-48705: Next fix in the same package (low confidence)CVE-2023-48705 → CVE-2023-50263: Next fix in the same package (low confidence)CVE-2023-50263 → CVE-2023-51649: Next fix in the same package (low confidence)CVE-2023-51649 → CVE-2024-23345: Next fix in the same package (low confidence) CVE-2023-46128 24 Oct 2023 CVE-2023-48705 22 Nov 2023 CVE-2023-50263 12 Dec 2023 CVE-2023-51649 22 Dec 2023 CVE-2024-23345 22 Jan 2024 CVE-2024-29199 26 Mar 2024 CVE-2024-36112 28 May 2024
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2023-46128 24 Oct 2023 Exposure of hashed user passwords via REST API in Nautobot · fixed in 2.0.3 First in chain 14.9
CVE-2023-48705 22 Nov 2023 nautobot has XSS potential in custom links, job buttons, and computed fields · fixed in 2.0.5 CVE-2023-46128 · Next fix in the same package · Low 14.1
CVE-2023-50263 12 Dec 2023 Nautobot allows unauthenticated db-file-storage views · fixed in 2.0.6 CVE-2023-48705 · Next fix in the same package · Low 13.6
CVE-2023-51649 22 Dec 2023 Nautobot missing object-level permissions enforcement when running Job Buttons · fixed in 2.1.0 CVE-2023-48705 · related · Medium 10.3
CVE-2024-23345 22 Jan 2024 Nautobot has XSS potential in rendered Markdown fields · fixed in 2.1.2 CVE-2023-48705 · related · Medium 12.5
CVE-2024-29199 26 Mar 2024 Unauthenticated views may expose information to anonymous users · fixed in 2.1.9 CVE-2024-23345 · Next fix in the same package · High 12.6
CVE-2024-36112 28 May 2024 Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects · fixed in 2.3.0b1 CVE-2024-29199 · related · Medium 11.2
↑ ↓ chooseEnter openEsc close