CVE-2019-9644

MEDIUM5.4EPSS 0.52%

Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

發布日:2022/5/14修改日:2026/4/28

也稱為:DEBIAN-CVE-2019-9644

描述

An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.

受影響套件(4)

Debian/jupyter-notebookfrom 0, < 5.7.8-1
PyPI/jupyter-notebookfrom 0, < 5.7.6
PyPI/notebookfrom 0, < 5.7.6
PyPI/notebookfrom 0, < 5.7.6

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

描述

受影響套件(4)

CVSS 分數

參考連結(9)