Log in Start free

Vulnerability · Published Aug 28, 2023 · Assigned by GitHub_M

CVE-2023-40170cross-site inclusion (XSSI) of files in jupyter-server

Medium 4.6

In plain English

A medium-severity improper access control in jupyter_server from jupyter-server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)0.6%top 49.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20jupyter-server2.7.3-r0ALPINE-CVE-2023-40170
Alpine:v3.21jupyter-server2.7.3-r0ALPINE-CVE-2023-40170
Alpine:v3.22jupyter-server2.7.3-r0ALPINE-CVE-2023-40170
Alpine:v3.23jupyter-server2.7.3-r0ALPINE-CVE-2023-40170
Alpine:v3.24jupyter-server2.7.3-r0ALPINE-CVE-2023-40170
Debian:12jupyter-serverno fix listedDEBIAN-CVE-2023-40170
Debian:13jupyter-server2.14.2-1DEBIAN-CVE-2023-40170
Debian:14jupyter-server2.14.2-1DEBIAN-CVE-2023-40170
PyPIjupyter-server2.7.2PYSEC-2023-157
PyPIjupyter-server2.7.2GHSA-64x5-55rw-9974
Ubuntu:22.04:LTSjupyter-serverno fix listedUBUNTU-CVE-2023-40170
Ubuntu:24.04:LTSjupyter-serverno fix listedUBUNTU-CVE-2023-40170
Ubuntu:25.10jupyter-serverno fix listedUBUNTU-CVE-2023-40170
Ubuntu:26.04:LTSjupyter-serverno fix listedUBUNTU-CVE-2023-40170
Ubuntu:26.10jupyter-serverno fix listedUBUNTU-CVE-2023-40170

Affected products (as reported)

VendorProductVersions
jupyter-server jupyter_server < 2.7.2

Weakness: CWE-284, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References