CVE Feed

    Dashboard / CVE / CVE-2024-32979

    CVE-2024-32979

    Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot versions 1.6.20 and 2.2.3. There are no known workarounds for this vulnerability.

    Published:May 1, 2024
    Last Modified:Aug 26, 2025
    EPS:May 1, 2024
    EPSS Score:0.00148
    CVSS Score:7.5

    Affected Products

    Vendor
    Networktocode
    Product
    Nautobot

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-44794 (CVSS 5.4) — Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case …
    CVE-2026-44796 (CVSS 6.5) — Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI …
    CVE-2026-44797 (CVSS 8.5) — Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's W…
    CVE-2026-44798 (CVSS 7.1) — Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with …
    CVE-2026-34203 (CVSS 2.7) — Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, us…
    CVE-2025-49143 (CVSS 6.3) — Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files up…
    CVE-2025-49142 (CVSS 6) — Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to…
    CVE-2024-36112 (CVSS 6.3) — Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic…
    CVE-2024-34707 (CVSS 7.5) — Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges c…
    CVE-2024-29199 (CVSS 3.7) — Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High