CVE-2024-23345

Summary

CVE-2024-23345 is a cross-site scripting (XSS) vulnerability affecting users of Nautobot, a Network Source of Truth and Network Automation Platform, prior to versions 1.6.10 and 2.1.2. This issue stems from inadequate input sanitization in user-editable fields that support Markdown rendering. Maliciously crafted data can exploit this vulnerability, leading to XSS attacks. By injecting malicious scripts, attackers may gain unauthorized access to user sessions or steal sensitive information. Users are advised to upgrade to Nautobot versions 1.6.10 or 2.1.2 to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.