XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing (jupyterhub jupyterhub)
En bref
- Source
- NVD
- EPSS
- EPSS 0.33 % · centile 26 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Analyzed
Rechercher sur…
Description
JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API and user's single-user server. The affected configurations are single-origin JupyterHub deployments and JupyterHub deployments with user-controlled applications running on subdomains or peer subdomains of either the Hub or a single-user server. This vulnerability is fixed in 4.1.0.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
- CWE-352 — Falsification de requête inter-site (CSRF)
- CWE-565 — Confiance accordée aux cookies sans validation ni contrôle d'intégrité
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | GitHub_M |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-7r3h-4ph8-w38g — Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing
- PYSEC-2026-1480 — Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing
Références européennes
- ENISA EUVD · EUVD-2024-0861
- GCVE · GCVE-0-2024-28233
Avis du CERT-FR
- CERTFR-2024-AVI-0529 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:jupyter:jupyterhub:*:*:*:*:*:*:*:*< 4.1.0
Produits affectés
| Produit | Versions |
|---|---|
| jupyterhub · jupyterhub | affected < 4.1.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |