CVE-2023-33796
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, potentially granting access to sensitive data stored in the database.
Risk Assessment
The organization may be exposed to the disclosure of confidential information, which could lead to privacy breaches and data security issues.
Recommendation
It is recommended to update to the latest version of Netbox and monitor logs for potential unauthorized queries.
Original NVD description (English source)
A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data stored in the database. NOTE: the vendor disputes this because the reporter's only query was for the schema of the API, which is public; queries for database objects would have been denied.