Threats tagged 'ghsa-5rfv-8fqh-fwgx'

NetBox versions from 2.9.0 up to but not including 4.7.4 contain a broken access control vulnerability in the BulkComponentCreateView. This flaw allows authenticated users with add-component permission to bypass view permissions on parent devices and virtual machines. Exploitation enables viewing out-of-scope device details and creating components on unauthorized devices or VMs by submitting arbitrary IDs or using filters.