CVE-2024-22420
Published Jan 19, 2024
Last updated 9 months ago
Overview
- Description
- JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab version 4.0.11 has been patched. Users are advised to upgrade. Users unable to upgrade should disable the table of contents extension.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 6.1
- Impact score
- 2.7
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "98056E64-C6C4-498A-9C3F-67A7F4F11261",
"versionEndExcluding": "4.0.11",
"versionStartIncluding": "4.0.0"
},
{
"criteria": "cpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF4CC1C2-B78B-466A-ACDE-4604DE69D4FD",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "7.0.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646"
}
],
"operator": "OR"
}
]
}
]