CVE-2024-28233: falha de alta gravidade em jupyterhub
XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.3%
JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API and user's single-user server. The affected configurations are single-origin JupyterHub deployments and JupyterHub deployments with user-controlled applications running on subdomains or peer subdomains of either the Hub or a single-user server. This vulnerability is fixed in 4.1.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Produtos afetados
jupyterhub · jupyterhubCVEs relacionadas — jupyterhub
No mesmo produto, das mais perigosas para as menos.
CVE-2021-41247LOWincomplete logout in JupyterHubEPSS 0.8%CVE-2024-41942HIGHJupyterHub has a privilege escalation vulnerability with the `admin:users` scopeEPSS 0.6%CVE-2026-54338MEDIUMJupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed LoginEPSS 0.4%CVE-2026-108752LOWJupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped HyphenEPSS 0.2%CVE-2026-33709MEDIUMJupyterHub has an Open Redirect VulnerabilityEPSS 0.2%CVE-2026-40864MEDIUMJupyterHub: Cross-origin form POSTs bypass XSRFEPSS 0.1%