PT-2024-19412 · Unknown+1 · Jupyterlab+2

Davwwwx · Published 2024-01-19 · Updated 2024-09-18 · CVE-2024-22421

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions JupyterLab versions prior to 4.1.0b2 JupyterLab versions prior to 4.0.11 JupyterLab versions prior to 3.6.7 jupyter-server versions prior to 2.7.2

Description JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version.

Recommendations For JupyterLab versions prior to 4.1.0b2, upgrade to version 4.1.0b2 or newer. For JupyterLab versions prior to 4.0.11, upgrade to version 4.0.11 or newer. For JupyterLab versions prior to 3.6.7, upgrade to version 3.6.7 or newer. For jupyter-server versions prior to 2.7.2, upgrade to version 2.7.2 or newer, which includes a redirect vulnerability fix.

Exploit

Fix

Information Disclosure

Relative Path Traversal

Weakness Enumeration

CWE-200

CWE-23

Related Identifiers

ALT-PU-2024-12926

BIT-JUPYTER-BASE-NOTEBOOK-2024-22421

BIT-JUPYTER-NOTEBOOK-2024-22421

BIT-JUPYTERLAB-2024-22421

CVE-2024-22421

GHSA-44CC-43RP-5947

OPENSUSE-SU-2024:13605-1

Affected Products

Alt Linux

Jupyterlab

Jupyter Server

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22421.json · Exploit
• https://github.com/jupyterlab/jupyterlab/commit/19bd9b96cb2e77170a67e43121637d0b5619e8c6 · Patch
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyter-notebook-2024-22421 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyterlab-2024-22421 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-22421 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22421 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-22421 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-22421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22421 · Security Note
• https://osv.dev/vulnerability/GHSA-44cc-43rp-5947 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-22421 · Security Note
• https://ubuntu.com/security/CVE-2024-22421 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyter-base-notebook-2024-22421 · Vendor Advisory