CVE-2023-51649

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
nautobot	nautobot	>= 1.5.14, < 1.6.8; >= 2.0.0, < 2.1.0

References

https://github.com/nautobot/nautobot/issues/4988Issue Tracking
https://github.com/nautobot/nautobot/pull/4993Issue Tracking, Patch
https://github.com/nautobot/nautobot/pull/4995Issue Tracking, Patch
https://github.com/nautobot/nautobot/security/advisories/GHSA-vf5m-xrhm-v999Patch, Vendor Advisory
https://github.com/nautobot/nautobot/issues/4988Issue Tracking
https://github.com/nautobot/nautobot/pull/4993Issue Tracking, Patch
https://github.com/nautobot/nautobot/pull/4995Issue Tracking, Patch
https://github.com/nautobot/nautobot/security/advisories/GHSA-vf5m-xrhm-v999Patch, Vendor Advisory

Timeline

Published: Dec 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-51658.8Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which CVE-2023-516507.5Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unautho CVE-2023-516513.3AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes CVE-2023-516526.1OWASP AntiSamy .NET is a library for performing cleansing of HTML coming from untrusted sources. Prior to version 1.2.0, there is a potentia CVE-2023-516539.8Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to J CVE-2023-516545.5Improper link resolution before file access ('Link Following') issue exists in iPrint&Scan Desktop for Windows versions 11.0.0 and earlier. CVE-2023-516559.8In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified CVE-2023-516569.8Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are reco CVE-2023-51666.5Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL. This issue affects Docker Desktop: before 4.23.0.CVE-2023-516618.6Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs CVE-2023-516627.5The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake CVE-2023-516635.3Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic dat