CVE-2024-22421 Potential authentication and CSRF tokens leak in JupyterLab

2024-01-1920:45:49

CWE-200

CWE-23

GitHub_M

www.cve.org

jupyterlab

authentication

csrf tokens

jupyter notebook

jupyter server

redirect vulnerability

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

28.1%

JSON

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade jupyter-server to version 2.7.2 or newer which includes a redirect vulnerability fix.

CNA Affected

[
  {
    "vendor": "jupyterlab",
    "product": "jupyterlab",
    "versions": [
      {
        "version": "< 3.6.7",
        "status": "affected"
      },
      {
        "version": ">=4.0.0,< 4.0.11",
        "status": "affected"
      }
    ]
  }
]