XSS in Jupyter Jupyter_server_proxy
CVE-2024-35225
Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (35.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
Affected products
- Jupyter Jupyter_server_proxy
- Jupyterhub Jupyter-server-proxy — versions >= 3.0.0, < 3.2.4, >= 4.0.0, < 4.2.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Product, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-35225?
- CVE-2024-35225 is a critical-severity vulnerability in Jupyter Jupyter_server_proxy, classified under Cross-site Scripting. CVSS score: 9.6/10. Published 2024-06-11.
- How severe is CVE-2024-35225?
- Critical severity. CVSS v3 base score is 9.6 out of 10.