CVE-2024-40735: 
NixOS vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability exists in netbox version 4.0.3 that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/{id}/edit/. The vulnerability was disclosed on July 9, 2024 and has been assigned CVE-2024-40735 (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) and Code Injection (CWE-94) weakness. It has received a CVSS v3.1 base score of 6.1 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed, with low impacts to both confidentiality and integrity (NVD).

The vulnerability allows attackers to execute arbitrary web scripts or HTML in the context of the targeted application. This can lead to theft of sensitive information, manipulation of web content, and potential compromise of user sessions (NVD).

The vulnerability can be exploited by sending a crafted payload to the Name parameter at the /dcim/power-outlets/{id}/edit/ endpoint. A proof of concept is available (Github POC).