BIT-jupyter-notebook-2024-22421

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/jupyter-notebook/BIT-jupyter-notebook-2024-22421.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-jupyter-notebook-2024-22421
Aliases
Published
2024-03-06T10:53:53.191Z
Modified
2025-05-20T10:02:07.006Z
Summary
Potential authentication and CSRF tokens leak in JupyterLab
Details

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade jupyter-server to version 2.7.2 or newer which includes a redirect vulnerability fix.

Database specific
{
    "cpes": [
        "cpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / jupyter-notebook

Package

Name
jupyter-notebook
Purl
pkg:bitnami/jupyter-notebook

Severity

  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
7.0.0