CVE-2015-6938

Severity Score

4.3

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Vulnerabilidad de XSS en el buscador de archivos en notebook/notebookapp.py en IPython Notebook en versiones anteriores a 3.2.2 y Jupyter Notebook 4.0.x en versiones anteriores a 4.0.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del nombre de una carpeta. NOTA: esta vulnerabilidad fue inicialmente reportada como (CSRF), pero esto puede ser incorrecto.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2015-09-14 CVE Reserved
2015-09-21 CVE Published
2024-08-06 CVE Updated
2024-08-06 First Exploit
2024-12-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (10)

URL	Tag	Source
http://seclists.org/oss-sec/2015/q3/474	Mailing List
https://bugzilla.redhat.com/show_bug.cgi?id=1259405	Issue Tracking

URL	Date	SRC
https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892	2024-08-06
https://github.com/jupyter/notebook/commit/35f32dd2da804d108a3a3585b69ec3295b2677ed	2024-08-06

URL	Date	SRC
http://seclists.org/oss-sec/2015/q3/544	2018-10-30
https://github.com/jupyter/notebook/commit/dd9876381f0ef09873d8c5f6f2063269172331e3	2018-10-30

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166460.html	2018-10-30
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166471.html	2018-10-30
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167670.html	2018-10-30
http://lists.opensuse.org/opensuse-updates/2015-10/msg00016.html	2018-10-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Jupyter Search vendor "Jupyter"		Notebook Search vendor "Jupyter" for product "Notebook"				4.0.0 Search vendor "Jupyter" for product "Notebook" and version "4.0.0"		-		Affected
Jupyter Search vendor "Jupyter"		Notebook Search vendor "Jupyter" for product "Notebook"				4.0.1 Search vendor "Jupyter" for product "Notebook" and version "4.0.1"		-		Affected
Jupyter Search vendor "Jupyter"		Notebook Search vendor "Jupyter" for product "Notebook"				4.0.2 Search vendor "Jupyter" for product "Notebook" and version "4.0.2"		-		Affected
Jupyter Search vendor "Jupyter"		Notebook Search vendor "Jupyter" for product "Notebook"				4.0.3 Search vendor "Jupyter" for product "Notebook" and version "4.0.3"		-		Affected
Jupyter Search vendor "Jupyter"		Notebook Search vendor "Jupyter" for product "Notebook"				4.0.4 Search vendor "Jupyter" for product "Notebook" and version "4.0.4"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				21 Search vendor "Fedoraproject" for product "Fedora" and version "21"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				22 Search vendor "Fedoraproject" for product "Fedora" and version "22"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				23 Search vendor "Fedoraproject" for product "Fedora" and version "23"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				13.1 Search vendor "Opensuse" for product "Opensuse" and version "13.1"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				13.2 Search vendor "Opensuse" for product "Opensuse" and version "13.2"		-		Affected
Ipython Search vendor "Ipython"		Notebook Search vendor "Ipython" for product "Notebook"				<= 3.2.1 Search vendor "Ipython" for product "Notebook" and version " <= 3.2.1"		-		Affected