CVE-2023-33799: 
NixOS vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability was discovered in Netbox version 3.5.1, specifically affecting the Create Contacts function located at /tenancy/contacts/. The vulnerability was disclosed on May 24, 2023, and allows attackers to execute arbitrary web scripts or HTML through crafted payloads injected into the Name field (NVD, Debian Tracker).

The vulnerability is classified as a stored XSS issue with a CVSS v3.1 base score of 5.4 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction. The scope is changed, with low impact on both confidentiality and integrity, but no impact on availability (NVD).

When successfully exploited, this vulnerability allows attackers to execute arbitrary web scripts or HTML in the context of other users' browsers who view the affected contact entries. This can lead to potential session hijacking, credential theft, or other client-side attacks against users who have access to the contacts section (GitHub Issue).