Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

nautobot-ssot

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3PyPIAmendedPublished

    Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL

    CVE-2025-62607 · GHSA-535g-62r7-cx6v

    Affected
    • PyPI nautobot-ssot < 3.10.0
    Fixed in
    3.10.0· Vendor fix available
    Issue
    The servicenow config URL is using a generic django View with no authentication. URL: /plugins/ssot/servicenow/config/ Impact What kind of vulnerability is it? Who is impacted? An Unauthenticated attacker could access this page to view the Service Now public instance name e.g. companyname.service-now.com. This is considered low-value information. This does not expose the Secret, the Secret Name, or the Secret Value for the Username/Password for Service-Now.com. An unauthenticated member would not be able to change the instance name, nor set a Secret. There is not a way to gain access to other pages Nautobot through the unauthenticated Configuration page. Patches Has the problem been patched? What versions should users upgrade to? We highly recommend upgrading to SSoT v3.10.0 which includes this patch. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? Disable the servicenow SSoT integration

    Recommended action: Upgrade to 3.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →