cross-site inclusion (XSSI) of files in jupyter-server

🗓️ 29 Aug 2023 23:34:09Reported by GitHub Advisory DatabaseType

Improper cross-site inclusion (XSSI) in Jupyter Server 2.7.2 could lead to exposure of certain file contents and accessing files when opening untrusted files

Reporter	Title	Published	Views	Family All 34
AlpineLinux	CVE-2023-40170	28 Aug 202320:01	–	alpinelinux
Chainguard	CVE-2023-40170 vulnerabilities	28 Aug 202321:15	–	cgr
Circl	CVE-2023-40170	29 Aug 202300:16	–	circl
CNNVD	Jupyter Server 访问控制错误漏洞	28 Aug 202300:00	–	cnnvd
CVE	CVE-2023-40170	28 Aug 202320:01	–	cve
Cvelist	CVE-2023-40170 cross-site inclusion (XSSI) of files in jupyter-server	28 Aug 202320:01	–	cvelist
Debian CVE	CVE-2023-40170	28 Aug 202320:01	–	debiancve
EUVD	EUVD-2023-0103	3 Oct 202520:07	–	euvd
Fedora	[SECURITY] Fedora 39 Update: python-jupyter-server-2.7.2-1.fc39	15 Sep 202319:04	–	fedora
Fedora	[SECURITY] Fedora 38 Update: python-jupyter-server-2.1.0-2.fc38	9 Sep 202301:35	–	fedora

Vulners

Node

jupyter-serverRange<2.7.2pip

Source	Link
github	www.github.com/jupyter-server/jupyter_server/security/advisories/GHSA-64x5-55rw-9974
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-40170
github	www.github.com/jupyter-server/jupyter_server/commit/87a4927272819f0b1cae1afa4c8c86ee2da002fd
github	www.github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2023-157.yaml
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/XDKQAWQN6SQTOVACZNXYKEHWQXGG4DOF/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/NRP7DNZYVOIA4ZB3U3ZWKTFZEPYWNGCQ/
github	www.github.com/advisories/GHSA-64x5-55rw-9974

11 Nov 2023 05:01Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.14.6 - 6.1

EPSS0.00722

SSVC

xssi jupyter server vulnerability