CVE-2024-36112

Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

State: Published
Severity: 6.3 Medium
Published: May 28, 2024
Updated: Aug 2, 2024
Reserved: May 20, 2024

Description

Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI view (`/extras/dynamic-groups/<uuid>/`) and/or the members REST API view (`/api/extras/dynamic-groups/<uuid>/members/`) to list the objects that are members of a given Dynamic Group. In versions of Nautobot between 1.3.0 (where the Dynamic Groups feature was added) and 1.6.22 inclusive, and 2.0.0 through 2.2.4 inclusive, Nautobot fails to restrict these listings based on the member object permissions - for example a Dynamic Group of Device objects will list all Devices that it contains, regardless of the user's `dcim.view_device` permissions or lack thereof. This issue has been fixed in Nautobot versions 1.6.23 and 2.2.5. Users are advised to upgrade. This vulnerability can be partially mitigated by removing `extras.view_dynamicgroup` permission from users however a full fix will require upgrading.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-280 Improper Handling of Insufficient Permissions or Privileges
CWE-755 Improper Handling of Exceptional Conditions

Affected Products

Product	Versions
nautobotnautobot	>= 1.3.0, < 1.6.23Affected >= 2.0.0, < 2.2.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.