CVE-2024-29199 (GCVE-0-2024-29199)

Vulnerability from cvelistv5 – Published: 2024-03-26 03:08 – Updated: 2024-08-02 16:13
VLAI?
Title
Unauthenticated views may expose information to anonymous users
Summary
Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9.
Severity ?
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
Vendor Product Version
nautobot nautobot Affected: < 1.6.16
Affected: >= 2.0.0, < 2.1.9
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:10:54.048Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4"
          },
          {
            "name": "https://github.com/nautobot/nautobot/pull/5464",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/pull/5464"
          },
          {
            "name": "https://github.com/nautobot/nautobot/pull/5465",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/pull/5465"
          },
          {
            "name": "https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750"
          },
          {
            "name": "https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb"
          },
          {
            "name": "https://github.com/nautobot/nautobot/releases/tag/v1.6.16",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/releases/tag/v1.6.16"
          },
          {
            "name": "https://github.com/nautobot/nautobot/releases/tag/v2.1.9",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nautobot/nautobot/releases/tag/v2.1.9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-29199",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-02T16:13:02.596894Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:13:27.128Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nautobot",
          "vendor": "nautobot",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-26T03:08:21.873Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4"
        },
        {
          "name": "https://github.com/nautobot/nautobot/pull/5464",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/pull/5464"
        },
        {
          "name": "https://github.com/nautobot/nautobot/pull/5465",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/pull/5465"
        },
        {
          "name": "https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750"
        },
        {
          "name": "https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb"
        },
        {
          "name": "https://github.com/nautobot/nautobot/releases/tag/v1.6.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/releases/tag/v1.6.16"
        },
        {
          "name": "https://github.com/nautobot/nautobot/releases/tag/v2.1.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nautobot/nautobot/releases/tag/v2.1.9"
        }
      ],
      "source": {
        "advisory": "GHSA-m732-wvh2-7cq4",
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated views may expose information to anonymous users"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-29199",
    "datePublished": "2024-03-26T03:08:21.873Z",
    "dateReserved": "2024-03-18T17:07:00.095Z",
    "dateUpdated": "2024-08-02T16:13:27.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4\", \"name\": \"https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/nautobot/nautobot/pull/5464\", \"name\": \"https://github.com/nautobot/nautobot/pull/5464\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nautobot/nautobot/pull/5465\", \"name\": \"https://github.com/nautobot/nautobot/pull/5465\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750\", \"name\": \"https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb\", \"name\": \"https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nautobot/nautobot/releases/tag/v1.6.16\", \"name\": \"https://github.com/nautobot/nautobot/releases/tag/v1.6.16\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/nautobot/nautobot/releases/tag/v2.1.9\", \"name\": \"https://github.com/nautobot/nautobot/releases/tag/v2.1.9\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T01:10:54.048Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-29199\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-02T16:13:02.596894Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-02T16:13:09.186Z\"}}], \"cna\": {\"title\": \"Unauthenticated views may expose information to anonymous users\", \"source\": {\"advisory\": \"GHSA-m732-wvh2-7cq4\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"nautobot\", \"product\": \"nautobot\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.6.16\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.0.0, \u003c 2.1.9\"}]}], \"references\": [{\"url\": \"https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4\", \"name\": \"https://github.com/nautobot/nautobot/security/advisories/GHSA-m732-wvh2-7cq4\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/nautobot/nautobot/pull/5464\", \"name\": \"https://github.com/nautobot/nautobot/pull/5464\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nautobot/nautobot/pull/5465\", \"name\": \"https://github.com/nautobot/nautobot/pull/5465\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750\", \"name\": \"https://github.com/nautobot/nautobot/commit/2fd95c365f8477b26e06d60b999ddd36882d5750\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb\", \"name\": \"https://github.com/nautobot/nautobot/commit/dd623e6c3307f48b6357fcc91925bcad5192abfb\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nautobot/nautobot/releases/tag/v1.6.16\", \"name\": \"https://github.com/nautobot/nautobot/releases/tag/v1.6.16\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nautobot/nautobot/releases/tag/v2.1.9\", \"name\": \"https://github.com/nautobot/nautobot/releases/tag/v2.1.9\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthenticated (anonymous) users. These endpoints will not disclose any Nautobot data to an unauthenticated user unless the Nautobot configuration variable EXEMPT_VIEW_PERMISSIONS is changed from its default value (an empty list) to permit access to specific data by unauthenticated users. This vulnerability is fixed in 1.6.16 and 2.1.9.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-03-26T03:08:21.873Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-29199\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T16:13:27.128Z\", \"dateReserved\": \"2024-03-18T17:07:00.095Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-03-26T03:08:21.873Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.