{"action":"Upgrade nautobot to 1.6.10 or later.","affected":[{"fixed":"1.6.10","introduced":"0"},{"fixed":"2.1.2","introduced":"2.0.0"}],"component":"nautobot","cve_ids":["CVE-2024-23345"],"ecosystem":"PyPI","epss":0.00433,"exploited":false,"fixed_versions":["2.1.2","1.6.10"],"ghsa_id":"GHSA-v4xv-795h-rv4h","id":"tcs_01M5KGM6E8VMVBNXKNR0S0FW04","modified_at":"2024-01-29T20:41:40.105029Z","published_at":"2024-01-23T00:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-16","https://github.com/nautobot/nautobot/security/advisories/GHSA-v4xv-795h-rv4h","https://github.com/nautobot/nautobot/pull/5133","https://github.com/nautobot/nautobot/pull/5134","https://github.com/nautobot/nautobot/commit/17effcbe84a72150c82b138565c311bbee357e80","https://github.com/nautobot/nautobot/commit/64312a4297b5ca49b6cdedf477e41e8e4fd61cce"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"PYSEC-2024-16","url":"https://osv.dev/vulnerability/PYSEC-2024-16"}],"summary":"Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site s"}