Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-62607

CVE-2025-62607: Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2025-62607
GHSA ID
GHSA-535g-62r7-cx6v
EPSS Score
-
CWE
CWE-306
Published
10/21/2025
Updated
10/21/2025
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
nautobot-ssotpip< 3.10.03.10.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability lies in the nautobot_ssot.integrations.servicenow.views.SSOTServiceNowConfigView class, which was responsible for rendering the ServiceNow configuration page. Before the patch, this class did not have any authentication or permission checks, allowing unauthenticated users to access it and view the ServiceNow instance name. The provided patch addresses this by adding the ObjectPermissionRequiredMixin to the view, which enforces that a user must have the 'change' permission for the SSOTServiceNowConfig model to access the page. The commit 1530d25cdeb929641ec47644f9a0a1d9d41e1cb8 clearly shows this change. The vulnerability is a classic case of missing authentication for a critical function, which in this case is the configuration view that exposes sensitive, albeit low-value, information.

Vulnerable functions

nautobot_ssot.integrations.servicenow.views.SSOTServiceNowConfigView
nautobot_ssot/integrations/servicenow/views.py
The vulnerability existed because the `SSOTServiceNowConfigView` class, which handles the ServiceNow configuration page, did not enforce any authentication or permission checks. It inherited directly from Django's `UpdateView`, making it publicly accessible. An unauthenticated attacker could access this view to retrieve the ServiceNow instance name. The patch mitigates this by adding the `ObjectPermissionRequiredMixin`, which ensures that only authenticated users with the necessary permissions can access the view.

WAF Protection Rules

WAF Rule

T** s*rvi**now *on*i* URL is usin* * **n*ri* *j*n*o Vi*w wit* no *ut**nti**tion. URL: `/plu*ins/ssot/s*rvi**now/*on*i*/` ### Imp**t _W**t kin* o* vuln*r**ility is it? W*o is imp**t**?_ *n Un*ut**nti**t** *tt**k*r *oul* ****ss t*is p*** to vi*w t**

Reasoning

T** vuln*r**ility li*s in t** `n*uto*ot_ssot.int**r*tions.s*rvi**now.vi*ws.SSOTS*rvi**Now*on*i*Vi*w` *l*ss, w*i** w*s r*sponsi*l* *or r*n**rin* t** S*rvi**Now *on*i*ur*tion p***. ***or* t** p*t**, t*is *l*ss *i* not **v* *ny *ut**nti**tion or p*rmiss
CVE-2025-62607: Nautobot SSoT ServiceNow Leak | Miggo