Lucene search

[email protected]CVE-2015-6938

HistorySep 21, 2015 - 7:59 p.m.

CVE-2015-6938

2015-09-2119:59:05

CWE-79

[email protected]

web.nvd.nist.gov

cve-2015-6938

cross-site scripting

xss

ipython notebook

jupyter notebook

remote attackers

html injection

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.6%

JSON

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Affected configurations

NVD

Node

jupyternotebookMatch4.0.0

jupyternotebookMatch4.0.1

jupyternotebookMatch4.0.2

jupyternotebookMatch4.0.3

jupyternotebookMatch4.0.4

Node

fedoraprojectfedoraMatch21

fedoraprojectfedoraMatch22

fedoraprojectfedoraMatch23

Node

opensuseopensuseMatch13.1

opensuseopensuseMatch13.2

Node

ipythonnotebookRange≤3.2.1

CPENameOperatorVersion
jupyter:notebookjupyter notebookeq4.0.0
jupyter:notebookjupyter notebookeq4.0.1
jupyter:notebookjupyter notebookeq4.0.2
jupyter:notebookjupyter notebookeq4.0.3
jupyter:notebookjupyter notebookeq4.0.4

CPE	Name	Operator	Version
jupyter:notebook	jupyter notebook	eq	4.0.0
jupyter:notebook	jupyter notebook	eq	4.0.1
jupyter:notebook	jupyter notebook	eq	4.0.2
jupyter:notebook	jupyter notebook	eq	4.0.3
jupyter:notebook	jupyter notebook	eq	4.0.4