CVE-2024-56916

Description

In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field rendering user supplied html. An authenticated attacker can leverage this to add malicious JavaScript to the any banner field. Once a victim edits a Configuration History version or attempts to Add a new version, the XSS payload will trigger.

Weakness classification

• 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Primary references

• cve@mitre.org — Release Notes
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Exploit