CVE-2023-40170CWE-284CWE-306

cross-site inclusion (XSSI) of files in jupyter-server

Medium · published August 28, 2023

CVSS v3.1
4.6
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00623 · 49.2th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-306 · Missing Authentication for Critical Function
Published
2023-08-28T20:01Z
EPSS history
Timeline
  • 28 AUG 20:01Z
    cross-site inclusion (XSSI) of files in jupyter-server
    cvelistv5