CVE-2024-34707

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
nautobot	nautobot	< 1.6.22; >= 2.0.0, < 2.2.4

References

https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51cPatch
https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423Patch
https://github.com/nautobot/nautobot/pull/5697Exploit, Patch
https://github.com/nautobot/nautobot/pull/5698Exploit, Patch
https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3Patch, Vendor Advisory
https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51cPatch
https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423Patch
https://github.com/nautobot/nautobot/pull/5697Exploit, Patch
https://github.com/nautobot/nautobot/pull/5698Exploit, Patch
https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3Patch, Vendor Advisory

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-347084.9Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacte CVE-2024-347095.4Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JW CVE-2024-34713.4The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make CVE-2024-347107.1Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious Jav CVE-2024-347118.2GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that CVE-2024-347126.5Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as `Client.rest.channels.removeBa CVE-2024-347133.5sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.CVE-2024-347147.6The Hoppscotch Browser Extension is a browser extension for Hoppscotch, a community-driven end-to-end open-source API development ecosystem.CVE-2024-347153.3Fides is an open-source privacy engineering platform. The Fides webserver requires a connection to a hosted PostgreSQL database for persiste CVE-2024-347166.1PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with custo CVE-2024-347175.3PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous m CVE-2024-347197.8In multiple locations, there is a possible permissions bypass due to a missing null check. This could lead to local escalation of privilege