CVE-2022-39286 Execution with Unnecessary Privileges in JupyterApp

2022-10-2600:00:00

CWE-250

CWE-269

GitHub_M

www.cve.org

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.4%

JSON

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

CNA Affected

[
  {
    "vendor": "jupyter",
    "product": "jupyter_core",
    "versions": [
      {
        "version": "< 4.11.2",
        "status": "affected"
      }
    ]
  }
]