CVE-2023-46128 - CVE House

Back to Database

Status published Medium CVE-2023-46128

Exposure of hashed user passwords via REST API in Nautobot

6.5 CVSS

Vulnerability Description

Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the `?depth=<N>` query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-46128

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from nautobot

View All →

Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL

Nautobot may allows uploaded media files to be accessible without authentication

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

Affected Vendor

nautobot

View all reports →

Affected Software

nautobot

Vulnerable Versions:

>= 2.0.0, < 2.0.3

Timeline

Official Publish: October 24th, 2023

Last Modified: September 11th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel