CVE-2024-32979

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot versions 1.6.20 and 2.2.3. There are no known workarounds for this vulnerability.

• CWE-79

• https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64ePatch
• https://github.com/nautobot/nautobot/pull/5646Patch
• https://github.com/nautobot/nautobot/pull/5647Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqgThird Party Advisory
• https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64ePatch
• https://github.com/nautobot/nautobot/pull/5646Patch
• https://github.com/nautobot/nautobot/pull/5647Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqgThird Party Advisory

Published

May 1, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32973Pluto is a superset of Lua 5.4 with a focus on general-purpo…4.8
• CVE-2024-32974Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-32975Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-32976Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-32977OctoPrint provides a web interface for controlling consumer …9.4
• CVE-2024-32978Kaminari is a paginator for web app frameworks and object re…6.6
• CVE-2024-3298Out-Of-Bounds Write and Type Confusion vulnerabilities exist…7.8
• CVE-2024-32980Spin is the developer tool for building and running serverle…9.1
• CVE-2024-32981Silverstripe framework is the PHP framework forming the base…5.4
• CVE-2024-32982Litestar and Starlite is an Asynchronous Server Gateway Inte…8.2
• CVE-2024-32983Misskey is an open source, decentralized microblogging platf…7.5
• CVE-2024-32984Yamux is a stream multiplexer over reliable, ordered connect…7.5