CVE-2023-48700 json
Clear Text Credentials Exposed via Onboarding Task
published 2023-11-21 2 y ago modified 2026-09-10 1 mo ago also GHSA-qf3c-rw9f-jh7v , PYSEC-2023-288 , EUVD-2023-0291
- cvss
- 5.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are visible via Job Results from an execution of an Onboarding Task. Version 3.0.0 fixes this issue; no known workarounds are available. Mitigation recommendations include deleting all Job Results for any onboarding task to remove clear text credentials from database entries that were run while on v2.0.X, upgrading to v3.0.0, and rotating any exposed credentials.
Patch / fix
- pypi nautobot-device-onboarding 3.0.0
- nautobot nautobot-plugin-device-onboarding 3.0.0
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | nautobot-device-onboarding | >=2.0.0, <3.0.0 |
3.0.0 |
Affected products
- nautobot nautobot-plugin-device-onboarding
Classification
References
-
github.com
/nautobot/nautobot-plugin-device-onboarding/security/advisories/GHSA-qf3c-rw9f-jh7v
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-48700
advisory
-
github.com
/nautobot/nautobot-plugin-device-onboarding
package
-
github.com
/pypa/advisory-database/tree/main/vulns/nautobot-device-onboarding/PYSEC-2023-288.yaml
web
Sources
- CVE List CVE-2023-48700
- GitHub Advisory GHSA-qf3c-rw9f-jh7v
- NVD CVE-2023-48700
- OSV PYSEC-2023-288
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.