PT-2023-7528 · Unknown+1 · Jupyter Server+1

Krsecu · Publicado 2023-12-04 · Atualizado 2023-12-14 · CVE-2023-49080

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jupyter Server versions prior to 2.11.2

Description The Jupyter Server has an issue related to unhandled errors in API requests coming from an authenticated user, which can include traceback information and path information. Since the requesting user already has arbitrary execution permissions in the same environment, the revealed paths are not considered particularly sensitive. There is no known mechanism to trigger these errors without authentication.

Recommendations For versions prior to 2.11.2, upgrade to version 2.11.2 or later, which includes a fix that no longer includes traceback information in JSON error responses. As a temporary workaround, consider restricting access to sensitive paths and information, but note that there are no known workarounds for this issue.

Exploit

Correção

Improper Access Control

Information Disclosure

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-284

CWE-200

CWE-209

Identificadores relacionados

BDU:2023-08582

CVE-2023-49080

GHSA-H56G-GQ9V-VC8R

OPENSUSE-SU-2024:13489-1

PYSEC-2023-272

Produtos afetados

Debian

Jupyter Server

Referências · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49080.json · Exploit
• https://github.com/jupyter-server/jupyter_server · Nota
• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-h56g-gq9v-vc8r · Nota
• https://github.com/jupyter-server/jupyter_server/commit/0056c3aa52cbb28b263a7a609ae5f17618b36652 · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2023-272.yaml · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-49080 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-h56g-gq9v-vc8r · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-49080 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1731783711392207271 · Publicação no Twitter
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FG2JWZI5KPUYMDPS53AIFTZJWZD3IT6I · Aviso do Fabricante
• https://t.me/cvenotify/63620 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-49080 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-49080 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-08582 · Nota de Segurança
• https://t.me/cvenotify/62187 · Publicação no Telegram