CVE-2023-46128 is a medium-severity information disclosure vulnerability affecting Nautobot versions 2.0.x. Authenticated users can exploit specific REST API endpoints with the "?depth=<N>" parameter to expose hashed user passwords from the database. While not plaintext, this still represents a significant compromise of sensitive information. The vulnerability has a CVSS score of 6.5 (Medium), indicating it can be exploited remotely with low attack complexity by a low-privileged attacker, leading to high confidentiality impact. It is categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-312 (Cleartext Storage of Sensitive Information). Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage. A patch is available in Nautobot version 2.0.3.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.0.0, < 2.0.3CPE matchmatch criteria | cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.