CVE-2024-22421CWE-200CWE-23

Potential authentication and CSRF tokens leak in JupyterLab

High · published January 19, 2024

CVSS v3.1
7.6
EPSS
1%
Percentile
51.4
In the wild
Unconfirmed
What it is

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00670 · 51.4th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-23 · Relative Path Traversal
Published
2024-01-19T20:45Z
EPSS history
Timeline
  • 19 JAN 20:45Z
    Potential authentication and CSRF tokens leak in JupyterLab
    cvelistv5