CVE-2024-29199

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
nautobot	nautobot	< 1.6.16; >= 2.0.0, < 2.1.9

References

Timeline

Published: Mar 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-29205.3The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 du CVE-2024-292006.5Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and t CVE-2024-292019.9JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation CVE-2024-292029.9JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template in CVE-2024-292036.1TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. CVE-2024-292049.8A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to e CVE-2024-292057.5An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti P CVE-2024-292062.2An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported CVE-2024-292077.5An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affe CVE-2024-292082.2An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the CVE-2024-292096.0A medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, which could allow an atta CVE-2024-29219.8Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to t