{"id":"CVE-2024-32979","aliases":["GHSA-jxgr-gcj5-cqqg","PYSEC-2026-1686"],"url":"https://o3.security/vulnerability/CVE-2024-32979","summary":"Reflected Cross-site Scripting potential in all object list views in Nautobot","details":"### Impact\n\nIt was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable, including:\n\n- /dcim/location-types/\n- /dcim/locations/\n- /dcim/racks/\n- /dcim/rack-groups/\n- /dcim/rack-reservations/\n- /dcim/rack-elevations/\n- /tenancy/tenants/\n- /tenancy/tenant-groups/\n- /extras/tags/\n- /extras/statuses/\n- /extras/roles/\n- /extras/dynamic-groups/\n- /dcim/devices/\n- /dcim/platforms/\n- /dcim/virtual-chassis/\n- /dcim/device-redundancy-groups/\n- /dcim/interface-redundancy-groups/\n- /dcim/device-types/\n- /dcim/manufacturers/\n- /dcim/cables/\n- /dcim/console-connections/\n- /dcim/power-connections/\n- /dcim/interface-connections/\n- /dcim/interfaces/\n- /dcim/front-ports/\n- /dcim/rear-ports/\n- /dcim/console-ports/\n- /dcim/console-server-ports/\n- /dcim/power-ports/\n- /dcim/power-outlets/\n- /dcim/device-bays/\n- /dcim/inventory-items/\n- /ipam/ip-addresses/\n- /ipam/prefixes\n- /ipam/rirs/\n- /ipam/namespaces/\n- /ipam/vrfs/\n- /ipam/route-targets/\n- /ipam/vlans/\n- /ipam/vlan-groups/\n- /ipam/services/\n- /virtualization/virtual-machines/\n- /virtualization/interfaces/\n- /virtualization/clusters/\n- /virtualization/cluster-types/\n- /virtualization/cluster-groups/\n- /circuits/circuits/\n- /circuits/circuit-types/\n- /circuits/providers/\n- /circuits/provider-networks/\n- /dcim/power-feeds/\n- /dcim/power-panels/\n- /extras/secrets/\n- /extras/secrets-groups/\n- /extras/jobs/\n- /extras/jobs/scheduled-jobs/approval-queue/\n- /extras/jobs/scheduled-jobs/\n- /extras/job-results/\n- /extras/job-hooks/\n- /extras/job-buttons/\n- /extras/object-changes/\n- /extras/git-repositories/\n- /extras/graphql-queries/\n- /extras/relationships/\n- /extras/notes/\n- /extras/config-contexts/\n- /extras/config-context-schemas/\n- /extras/export-templates/\n- /extras/external-integrations/\n- /extras/webhooks/\n- /extras/computed-fields/\n- /extras/custom-fields/\n- /extras/custom-links/\n\nas well as any similar object-list views provided by any Nautobot App.\n\n### Patches\n\nFixed in Nautobot 1.6.20 and 2.2.3.\n\n### Workarounds\n\nNo workaround has been identified\n\n### References\n\n- #5646 \n- #5647\n\n**Credit to [Michael Panorios](mailto:michael.panorios@pwc.com) for reporting this issue.**","published":"2024-05-01T10:49:56.643Z","modified":"2026-08-12T03:51:26.099967925Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"nautobot","fixedVersion":"1.6.20"},{"ecosystem":"PyPI","name":"nautobot","fixedVersion":"2.2.3"}],"fix":{"url":"https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e","label":"nautobot/nautobot@42440eb"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32979.json"},{"type":"ADVISORY","url":"https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32979"},{"type":"FIX","url":"https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e"},{"type":"FIX","url":"https://github.com/nautobot/nautobot/pull/5646"},{"type":"FIX","url":"https://github.com/nautobot/nautobot/pull/5647"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/commit/2ea5797ea43646d5d8b29433e4c707b5a9758146"},{"type":"PACKAGE","url":"https://github.com/nautobot/nautobot"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/releases/tag/v1.6.20"},{"type":"WEB","url":"https://github.com/nautobot/nautobot/releases/tag/v2.2.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:26.099967925Z"}}