TI-2024-23004 Aliases CVE-2024-34707 GHSA-r2hr-4v48-fjv3

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

LOW 34CWE-79Published 2024-05-13 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00606 49th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed nautobot (nautobot): 1.6.22, 2.2.4nautobot (PyPI): 1.6.22, 2.2.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nautobot	nautobot	before 1.6.22; 2.0.0 to before 2.2.4	1.6.22, 2.2.4	Patch available	CNA
—	nautobot (PyPI)	before 1.6.22	1.6.22	Patch available	GHSA-r2hr-4v48-fjv3
—	nautobot (PyPI)	2.0.0 to before 2.2.4	2.2.4	Patch available	GHSA-r2hr-4v48-fjv3

nautobot Vendornautobot Affected before 1.6.22; 2.0.0 to before 2.2.4 Fixed in 1.6.22, 2.2.4 Patch available CNA
nautobot (PyPI) Vendor— Affected before 1.6.22 Fixed in 1.6.22 Patch available GHSA-r2hr-4v48-fjv3
nautobot (PyPI) Vendor— Affected 2.0.0 to before 2.2.4 Fixed in 2.2.4 Patch available GHSA-r2hr-4v48-fjv3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:networktocode:nautobot::::::::	before 1.6.22; 2.0.0 to before 2.2.4	Vulnerable	Networktocode

cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:* Versions before 1.6.22; 2.0.0 to before 2.2.4 Vulnerable ·Networktocode

Remediation

Fix · CNA nautobot (nautobot) Fixed in 1.6.22, 2.2.4
Fix · GHSA-r2hr-4v48-fjv3 nautobot (PyPI) Fixed in 1.6.22 Advisory →
Fix · GHSA-r2hr-4v48-fjv3 nautobot (PyPI) Fixed in 2.2.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-34707
2026-10-03 Alias added: GHSA-r2hr-4v48-fjv3

References

Exploit 2

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-34707

Other 1

https://github.com/nautobot/nautobot

TI-2023-10938 Remote code execution in Jinja2 template rendering in Nautobot CVSS 3.1CRITICAL 9.8
TI-2026-32681 Nautobot: Webhook definitions could be used for server-side request forgery (SSRF) CVSS 3.1HIGH 8.5
TI-2024-21845 Reflected Cross-site Scripting potential in all object list views in Nautobot CVSS 3.1HIGH 7.5
TI-2024-15445 Nautobot has XSS potential in rendered Markdown fields CVSS 3.1HIGH 7.1
TI-2023-26544 nautobot has XSS potential in custom links, job buttons, and computed fields CVSS 3.1HIGH 7.1
TI-2026-32682 Nautobot: GitRepository.current_head field should not be writable through REST API CVSS 3.1HIGH 7.1

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences