PT-2023-7528 · Unknown+1 · Jupyter Server+1

Krsecu · Published 2023-12-04 · Updated 2023-12-14 · CVE-2023-49080

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jupyter Server versions prior to 2.11.2

Description The Jupyter Server has an issue related to unhandled errors in API requests coming from an authenticated user, which can include traceback information and path information. Since the requesting user already has arbitrary execution permissions in the same environment, the revealed paths are not considered particularly sensitive. There is no known mechanism to trigger these errors without authentication.

Recommendations For versions prior to 2.11.2, upgrade to version 2.11.2 or later, which includes a fix that no longer includes traceback information in JSON error responses. As a temporary workaround, consider restricting access to sensitive paths and information, but note that there are no known workarounds for this issue.

Exploit

Fix

Improper Access Control

Information Disclosure

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-284

CWE-200

CWE-209

Related Identifiers

BDU:2023-08582

CVE-2023-49080

GHSA-H56G-GQ9V-VC8R

OPENSUSE-SU-2024:13489-1

PYSEC-2023-272

Affected Products

Debian

Jupyter Server

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49080.json · Exploit
• https://github.com/jupyter-server/jupyter_server/commit/0056c3aa52cbb28b263a7a609ae5f17618b36652 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-49080 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h56g-gq9v-vc8r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49080 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FG2JWZI5KPUYMDPS53AIFTZJWZD3IT6I · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49080 · Security Note
• https://ubuntu.com/security/CVE-2023-49080 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08582 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-49080 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-49080 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/62LO7PPIAMLIDEKUOORXLHKLGA6QPL77 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-272 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-49080 · Security Note
• https://github.com/jupyter-server/jupyter_server · Note