CVE-2022-24758highCWE-532

CVE-2022-24758: fallo de gravedad alta en jupyter notebook

Insertion of Sensitive Information into Log File affects Jupyter Notebook

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear notebook+ Monitorear notebook

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 1.1%
The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter notebook version 6.4.x contains a patch for this issue. There are currently no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
jupyter · notebook
CVEs relacionadas — jupyter notebook

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-32798CRITICALFailure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebookEPSS 2.1%CVE-2020-26215MEDIUMOpen redirect in Jupyter NotebookEPSS 1.2%CVE-2022-29238MEDIUMForced Browsing in Jupyter NotebookEPSS 1.2%CVE-2026-42557HIGHjupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted contentEPSS 0.5%CVE-2026-40171HIGHJupyter Notebook and JupyterLab token theft via stored XSS in help command linkerEPSS 0.5%