RCE in Ipython Notebook
CVE-2014-3429
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.047 (90.8th percentile) — read the EPSS interpretation.
Affected products
- Ipython Ipython_notebook — versions 0.12, 0.12.1, 0.13
- Mageia — versions 3.0, 4.0
- Opensuse — versions 13.1, 13.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_SUSE)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Issue Tracking)
- cve@mitre.org (x_refsource_CONFIRM, Issue Tracking)
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
- cve@mitre.org (Press/Media Coverage, Technical Description, x_refsource_CONFIRM)
- cve@mitre.org (mailing-list, x_refsource_MLIST, VDB Entry, Third Party Advisory)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Broken Link)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA, Broken Link)