CVE-2015-6938
21.09.2015, 19:59
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
| Vendor | Product | Version |
|---|---|---|
| jupyter | notebook | 4.0.0 |
| jupyter | notebook | 4.0.1 |
| jupyter | notebook | 4.0.2 |
| jupyter | notebook | 4.0.3 |
| jupyter | notebook | 4.0.4 |
| opensuse | opensuse | 13.1 |
| opensuse | opensuse | 13.2 |
| ipython | notebook | 𝑥 ≤ 3.2.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ipython |
|
References