CVE-2023-48700

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are visible via Job Results from an execution of an Onboarding Task. Version 3.0.0 fixes this issue; no known workarounds are available. Mitigation recommendations include deleting all Job Results for any onboarding task to remove clear text credentials from database entries that were run while on v2.0.X, upgrading to v3.0.0, and rotating any exposed credentials.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-256CWE-312

Affected software

No affected versions have been published.

Timeline

Published
Nov 21, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-487016.1Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look liCVE-2023-487027.2Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrCVE-2023-487037.5RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This iCVE-2023-487047.5ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap CVE-2023-487055.4Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier thanCVE-2023-487064.7Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very fiCVE-2023-487076.5CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHACVE-2023-487086.5CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recCVE-2023-487098.0iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include mCVE-2023-48719.8A vulnerability classified as critical was found in SourceCodester Contact Manager App 1.0. This vulnerability affects unknown code of the fCVE-2023-487109.8iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted CVE-2023-487113.7google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery (SSRF) Vuln
CVE-2023-48700: Medium severity, CVSS 6.5 | Vulnix