CVE-2015-6938

MEDIUM6.1EPSS 0.86%

Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

Published: 5/14/2022Modified: 9/23/2024

Also known as:GHSA-4vwq-x64q-j4cjDEBIAN-CVE-2015-6938PYSEC-2015-24PYSEC-2015-26

Description

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Affected packages (5)

Debian/ipythonfrom 0, < 2.4.1-1
PyPI/ipythonfrom 0, < 3.2.2
PyPI/ipythonfrom 0, < 3ab41641cf6fce3860c73d5cf4645aa12e1e5892 | from 0, < 3.2.2
PyPI/notebook>= 4.0.0, < 4.0.5
PyPI/notebookfrom 0, < 35f32dd2da804d108a3a3585b69ec3295b2677ed, < dd9876381f0ef09873d8c5f6f2063269172331e3 | >= 4.0.0, < 4.0.5

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Affected packages (5)

CVSS scores

References (15)