CyberRota Analysis
AI-GeneratedNetBox versions up to 4.7.0 are vulnerable due to inadequate redaction of sensitive backend credentials in API responses, allowing authenticated users with view permissions to access plaintext passwords and secret keys for Git and Amazon S3. This exposure can lead to unauthorized access to external repositories and storage buckets, posing a risk to data integrity and confidentiality. Organizations using NetBox should prioritize remediation to protect sensitive information from potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.