CVE Vulnerability

CVE-2021-32798

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

6.8 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

9.6 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/jupyter/notebook/security/advisories/GHSA-hwvq-6gjx-j797 Third Party Advisory
https://github.com/jupyter/notebook/commit/79fc76e890a8ec42f73a3d009e44ef84c14ef0d5 Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:jupyter:notebook:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*
Information

Published : 2021-08-09 09:15

Updated : 2021-08-17 05:08

NVD link : CVE-2021-32798

Mitre link : CVE-2021-32798

Products Affected
No products.
CWE
CWE-79