{"action":"Upgrade nautobot to 1.6.6 or later.","affected":[{"fixed":"1.6.6","introduced":"0"},{"fixed":"2.0.5","introduced":"2.0.0"}],"component":"nautobot","cve_ids":["CVE-2023-48705"],"ecosystem":"PyPI","epss":0.00543,"exploited":false,"fixed_versions":["2.0.5","1.6.6"],"ghsa_id":"GHSA-cf9f-wmhp-v4pr","id":"tcs_01M5KGKAJTD1WCS6DC7BRPG33B","modified_at":"2024-11-21T14:57:22.412165Z","published_at":"2023-11-22T16:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-285","https://github.com/nautobot/nautobot/security/advisories/GHSA-cf9f-wmhp-v4pr","https://github.com/nautobot/nautobot/pull/4832","https://github.com/nautobot/nautobot/pull/4833","https://github.com/nautobot/nautobot/commit/362850f5a94689a4c75e3188bf6de826c3b012b2","https://github.com/nautobot/nautobot/commit/54abe23331b6c3d0d82bf1b028c679b1d200920d","https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.html.format_html","https://docs.djangoproject.com/en/3.2/ref/utils/#django.utils.safestring.mark_safe"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"PYSEC-2023-285","url":"https://osv.dev/vulnerability/PYSEC-2023-285"}],"summary":"Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are potentially affected by a cross-site scr"}