CVE Feed

    Dashboard / CVE / CVE-2024-23345

    CVE-2024-23345

    Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.

    Published:Jan 22, 2024
    Last Modified:May 30, 2025
    EPS:Jan 22, 2024
    EPSS Score:0.00412
    CVSS Score:7.1

    Affected Products

    Vendor
    Networktocode
    Product
    Nautobot

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-44794 (CVSS 5.4) — Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case …
    CVE-2026-44796 (CVSS 6.5) — Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI …
    CVE-2026-44797 (CVSS 8.5) — Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's W…
    CVE-2026-44798 (CVSS 7.1) — Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with …
    CVE-2026-34203 (CVSS 2.7) — Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, us…
    CVE-2025-49143 (CVSS 6.3) — Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files up…
    CVE-2025-49142 (CVSS 6) — Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to…
    CVE-2024-36112 (CVSS 6.3) — Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic…
    CVE-2024-34707 (CVSS 7.5) — Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges c…
    CVE-2024-32979 (CVSS 7.5) — Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Djan…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High