We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field rendering user supplied html. An authenticated attacker can leverage this to add malicious JavaScript to the any banner field. Once a victim edits a Configuration History version or attempts to Add a new version, the XSS payload will trigger.
Reserved 2025-01-09 | Published 2025-06-24 | Updated 2025-06-24 | Assigner mitregithub.com/netbox-community/netbox/releases/tag/v4.1.7
www.youtube.com/watch?v=GC8-PUlu2i8
github.com/...ulnerability-Research/tree/main/CVE-2024-56916
Support options
