Reflected Cross-site Scripting (XSS)

2024-06-1208:26:31

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

jupyter-server-proxy

xss

improper sanitization

phishing link

javascript

jupyterlab

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

6.2

Confidence

High

JSON

jupyter-server-proxy is vulnerable to Reflected Cross-site Scripting (XSS). The vulnerability is due to improper sanitization of the host value in the /proxy endpoint, allowing an attacker to send a phishing link with custom JavaScript that runs when the user clicks the link, potentially granting extensive access to the user’s JupyterLab instance.