CVE-2023-49080
CVE-2023-49080 — Jupyter Server errors include tracebacks with path information
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit `0056c3aa52` which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published Updated Sources: cvelistV5, GitHub_M
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.
Exploitation
Unreported
no source claims exploitation
EPSS
1%
chance of exploitation in 30 days
CVSS base
3.5
LOW
Affected scope
The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.
Vendors (1)
Products (1)
Every base score collected
Sources score independently and disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Source |
|---|---|---|---|---|---|
| 3.5 | CVSS 3.1 | LOW | — | — | cvelistV5 |
Weakness & attack patterns
- CWE-209
References
4 on the record
- github.com/jupyter-server/jupyter_server/security/advisories/GHSA-h56g-gq9v-vc8r
x_refsource_CONFIRM
- github.com/jupyter-server/jupyter_server/commit/0056c3aa52cbb28b263a7a609ae5f17618b36652
x_refsource_MISC
- lists.fedoraproject.org/archives/list/[email protected]/message/62LO7PPIAMLIDEKUOORXLHKLGA6QPL77/
reference
- lists.fedoraproject.org/archives/list/[email protected]/message/FG2JWZI5KPUYMDPS53AIFTZJWZD3IT6I/
reference
Elsewhere on this site
- jupyter serverevery CVE for this vendor
- CWE-209other pages naming this weakness
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.