CVE-2023-46128

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the `?depth=<N>` query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-312

Affected software

No affected versions have been published.

Timeline

Published
Oct 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-461297.5NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge compuCVE-2023-46139.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not reCVE-2023-461305.4Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the CVE-2023-461317.5Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVMCVE-2023-461326.5Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linkinCVE-2023-461339.1CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaCVE-2023-461349.8D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users CVE-2023-461357.5rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.CVE-2023-461367.5Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8,CVE-2023-461375.3Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP pCVE-2023-461385.3JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0CVE-2023-461395.7KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device i