CVE-2023-46128

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-46128
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-46128.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-46128
Aliases
Published
2023-10-24T14:17:52.830Z
Modified
2025-11-29T12:14:37.164434Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Exposure of hashed user passwords via REST API in Nautobot
Details

Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the ?depth=<N> query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46128.json"
}
References

Affected packages

Git / github.com/nautobot/nautobot

Affected ranges

Type
GIT
Repo
https://github.com/nautobot/nautobot
Events
Introduced
3013f25b41a1409adb815afb654fad4988f640ef
Fixed
ea72936a37a83a90786735c51b0255d6ba32fb5d

Affected versions

v2.*

v2.0.0
v2.0.1
v2.0.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-46128.json"