| Package | Affected versions | Patched versions |
|---|---|---|
| nautobot | ≥ 2.0.0, < 2.1.2< 1.6.10 | 2.1.21.6.10 |
| nautobot | ≥ 2.0.0, < 2.1.2< 1.6.10 | 2.1.21.6.10 |
All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted.
Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including:
Circuit.commentsCluster.commentsCustomField.descriptionDevice.commentsDeviceRedundancyGroup.commentsDeviceType.commentsJob.descriptionJobLogEntry.messageLocation.commentsNote.notePowerFeed.commentsProvider.noc_contactProvider.admin_contactProvider.commentsProviderNetwork.commentsRack.commentsTenant.commentsVirtualMachine.commentsmarkdowndescription attributesSUPPORT_MESSAGE system configuration settingare potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data.
Fixed in Nautobot versions 1.6.10 and 2.1.2.
https://github.com/nautobot/nautobot/pull/5133 https://github.com/nautobot/nautobot/pull/5134
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free