starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Auto-Completion Enabled for Password Fields #6136

New Issue
Closed
opened 2025-12-29 19:37:13 +01:00 by adam · 5 comments
adam commented 2025-12-29 19:37:13 +01:00
Owner
Copy Link

Originally created by @jvaltrick on GitHub (Feb 23, 2022).

NetBox version

v3.1.8

Python version

3.8

Steps to Reproduce

Is necessary to execute a security check to see the issue, if you do that, you will receive the bellow security issue:

cvss v2: 1.7
cvss v3: 4.0
(1) - Auto-Completion Enabled for Password Fields

In this case was used Trustwave tool to do the tests.

Expected Behavior

Don't be vulnerable.

Observed Behavior

Show me a security issue.

Originally created by @jvaltrick on GitHub (Feb 23, 2022). ### NetBox version v3.1.8 ### Python version 3.8 ### Steps to Reproduce Is necessary to execute a security check to see the issue, if you do that, you will receive the bellow security issue: cvss v2: 1.7 cvss v3: 4.0 (1) - Auto-Completion Enabled for Password Fields In this case was used Trustwave tool to do the tests. ### Expected Behavior Don't be vulnerable. ### Observed Behavior Show me a security issue.
adam closed this issue 2025-12-29 19:37:13 +01:00
adam commented 2025-12-29 19:37:13 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Feb 24, 2022):

This is neither a bug nor a security vulnerability.

@jeremystretch commented on GitHub (Feb 24, 2022): This is neither a bug nor a security vulnerability.
adam commented 2025-12-29 19:37:14 +01:00
Author
Owner
Copy Link

@jvaltrick commented on GitHub (Feb 24, 2022):

Hello Jeremy,

Sorry, but it is a security issue, you can see more here:

https://www.tenable.com/plugins/was/98081

image

https://nvd.nist.gov/vuln/detail/CVE-2020-1769

image

But if you think no, thats okay, otherwise the correction is simple like posted before.

Thanks by attention!

@jvaltrick commented on GitHub (Feb 24, 2022): Hello Jeremy, Sorry, but it is a security issue, you can see more here: https://www.tenable.com/plugins/was/98081 ![image](https://user-images.githubusercontent.com/28768636/155576880-959a6506-4dec-4262-b2ca-ee056a5d260e.png) https://nvd.nist.gov/vuln/detail/CVE-2020-1769 ![image](https://user-images.githubusercontent.com/28768636/155577013-225a584a-f297-4574-acaf-a413a905d625.png) But if you think no, thats okay, otherwise the correction is simple like posted before. Thanks by attention!
adam commented 2025-12-29 19:37:14 +01:00
Author
Owner
Copy Link

@kkthxbye-code commented on GitHub (Feb 24, 2022):

@jvaltrick All major browsers ignore autocomplete=off if the form contains username/password fields. Please don't create issues based on automatic security scans, especially if you don't understand the output.

@kkthxbye-code commented on GitHub (Feb 24, 2022): @jvaltrick All major browsers ignore autocomplete=off if the form contains username/password fields. Please don't create issues based on automatic security scans, especially if you don't understand the output.
adam commented 2025-12-29 19:37:14 +01:00
Author
Owner
Copy Link

@jvaltrick commented on GitHub (Feb 24, 2022):

@jvaltrick All major browsers ignore autocomplete=off if the form contains username/password fields. Please don't create issues based on automatic security scans, especially if you don't understand the output.

Hello, I don't know what world you live, but on real world there are somethings called security certifications and they require some requisites based on facts acknowled. My intention was just contribute to project, but by I see the same isn't open to suggestions or corretions.

About this: "All major browsers ignore autocomplete=off"

Following your line of reasoning: All criminals break into houses, almost all thieves break down doors, so I don't need any more doors or locks?

Yet: "Please don't create issues based on automatic security scans, especially if you don't understand the output."
I understand the output, as well as I understand that good practices and suggestions from different entities must be followed, which you don't seem to understand.

@jvaltrick commented on GitHub (Feb 24, 2022): > @jvaltrick All major browsers ignore autocomplete=off if the form contains username/password fields. Please don't create issues based on automatic security scans, especially if you don't understand the output. Hello, I don't know what world you live, but on real world there are somethings called security certifications and they require some requisites based on facts acknowled. My intention was just contribute to project, but by I see the same isn't open to suggestions or corretions. About this: "All major browsers ignore autocomplete=off" Following your line of reasoning: All criminals break into houses, almost all thieves break down doors, so I don't need any more doors or locks? Yet: "Please don't create issues based on automatic security scans, especially if you don't understand the output." I understand the output, as well as I understand that good practices and suggestions from different entities must be followed, which you don't seem to understand.
adam commented 2025-12-29 19:37:14 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Feb 24, 2022):

As stated, the proposed change is unnecessary. Locking.

@jeremystretch commented on GitHub (Feb 24, 2022): As stated, the proposed change is unnecessary. Locking.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#6136
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?