CVE-2024-34707

Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these settings are used to provide custom banner text at the top and bottom of all Nautobot web pages (or specifically on the login page in the case of `BANNER_LOGIN`) but it was reported that an admin user can make use of these settings to inject arbitrary HTML, potentially exposing Nautobot users to security issues such as cross-site scripting (stored XSS). The vulnerability is fixed in Nautobot 1.6.22 and 2.2.4.

• CWE-79

• https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51cPatch
• https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423Patch
• https://github.com/nautobot/nautobot/pull/5697Exploit, Patch
• https://github.com/nautobot/nautobot/pull/5698Exploit, Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3Patch, Vendor Advisory
• https://github.com/nautobot/nautobot/commit/4f0a66bd6307bfe0e0acb899233e0d4ad516f51cPatch
• https://github.com/nautobot/nautobot/commit/f640aedc69c848d3d1be57f0300fc40033ff6423Patch
• https://github.com/nautobot/nautobot/pull/5697Exploit, Patch
• https://github.com/nautobot/nautobot/pull/5698Exploit, Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hr-4v48-fjv3Patch, Vendor Advisory

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3470An Improper Privilege Management vulnerability was identifie…7.2
• CVE-2024-34701CreateWiki is Miraheze's MediaWiki extension for requesting …5.9
• CVE-2024-34702Botan is a C++ cryptography library. X.509 certificates can …5.3
• CVE-2024-34703Botan is a C++ cryptography library. X.509 certificates can …7.5
• CVE-2024-34704era-compiler-solidity is the ZKsync compiler for Solidity. …5.9
• CVE-2024-34706Valtimo is an open source business process and case manageme…9.8
• CVE-2024-34708Directus is a real-time API and App dashboard for managing S…4.9
• CVE-2024-34709Directus is a real-time API and App dashboard for managing S…5.4
• CVE-2024-3471The Button Generator WordPress plugin before 3.0 does not h…3.4
• CVE-2024-34710Wiki.js is al wiki app built on Node.js. Client side templat…7.1
• CVE-2024-34711GeoServer is an open source server that allows users to shar…8.2
• CVE-2024-34712Oceanic is a NodeJS library for interfacing with Discord. Pr…6.5