CVE-2022-24758highCWE-532

CVE-2022-24758: falha de alta gravidade em jupyter notebook

Insertion of Sensitive Information into Log File affects Jupyter Notebook

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar notebook+ Monitorar notebook

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 1.1%
The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter notebook version 6.4.x contains a patch for this issue. There are currently no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
jupyter · notebook
CVEs relacionadas — jupyter notebook

No mesmo produto, das mais perigosas para as menos.

CVE-2021-32798CRITICALFailure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebookEPSS 2.1%CVE-2020-26215MEDIUMOpen redirect in Jupyter NotebookEPSS 1.2%CVE-2022-29238MEDIUMForced Browsing in Jupyter NotebookEPSS 1.2%CVE-2026-42557HIGHjupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted contentEPSS 0.5%CVE-2026-40171HIGHJupyter Notebook and JupyterLab token theft via stored XSS in help command linkerEPSS 0.5%