CVE-2018-19352 — Cross-site Scripting in Notebook

CWE-79 — Cross-site Scripting9 documents7 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 48.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Jupyter Notebook
Timeline
PublishedNov 18
Latest updateJun 30

Description

Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDjupyter/notebook< 5.7.2
▶PyPIjupyter/notebook< 5.7.2

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Jupyter Notebook XSS via directory name↗2018-11-21
▶
GHSA
Jupyter Notebook XSS via directory name↗2018-11-21
▶
CVEList
CVE-2018-19352: Jupyter Notebook before 5↗2018-11-18
▶
OSV
CVE-2018-19352: Jupyter Notebook before 5↗2018-11-18
▶

📋Vendor Advisories

1
Debian
CVE-2018-19352: jupyter-notebook - Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because no...↗2018
▶

📄Research Papers

1
arXiv
Threat Assessment in Machine Learning based Systems↗2022-06-30
▶

💬Community

2
Bugzilla
CVE-2018-19351 CVE-2018-19352 python-notebook: various flaws [fedora-all]↗2018-11-21
▶
Bugzilla
CVE-2018-19352 python-notebook: XSS via an crafted directory↗2018-11-21
▶
CVE-2018-19352 — Cross-site Scripting in Notebook | cvebase