CVE-2023-51649

2 advisories.

PyPI/nautobot CVE-2023-51649: low 3.5

Nautobot missing object-level permissions enforcement when running Job Buttons

Action: Upgrade nautobot to 1.6.8 or later.

pip install nautobot==1.6.8

pip install nautobot==2.1.0

Affected

introduced	fixed	last affected
1.5.14	1.6.8	-
2.0.0	2.1.0	-

Fixed versions

1.6.8

2.1.0

Sources

osv: GHSA-vf5m-xrhm-v999
https://github.com/nautobot/nautobot/security/advisories/GHSA-vf5m-xrhm-v999
https://nvd.nist.gov/vuln/detail/CVE-2023-51649
https://github.com/nautobot/nautobot/issues/4988
https://github.com/nautobot/nautobot/pull/4993
https://github.com/nautobot/nautobot/pull/4995
https://github.com/nautobot/nautobot/commit/3d964f996f4926126c1d7853ca87b2ff475997a2
https://github.com/nautobot/nautobot/commit/d33d0c15a36948c45244e5b5e10bc79b8e62de7f
https://github.com/nautobot/nautobot
https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2023-287.yaml

CVE-2023-51649 · published 2023-12-22T19:51:53Z · modified 2026-06-09T13:15:18.125980805Z · JSON

PyPI/nautobot CVE-2023-51649: medium 4.3

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via