PYSEC-2023-220

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/nautobot/PYSEC-2023-220.yaml
JSON Data
https://api.test.osv.dev/v1/vulns/PYSEC-2023-220
Aliases
Published
2023-10-25T18:17:00Z
Modified
2023-11-01T18:56:17.509493Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the ?depth=<N> query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3.

References

Affected packages

PyPI / nautobot

Package

Affected ranges

Type
GIT
Repo
https://github.com/nautobot/nautobot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.0.3

Affected versions

2.*

2.0.0
2.0.1
2.0.2