CVE-2015-6938: XSS
A flaw was found in IPython's notebook handling:
Local folder name was used in HTML templates without escaping, allowing XSS in said pages by carefully crafting folder name and URL to access it.
Original report:
http://seclists.org/oss-sec/2015/q3/474
Upstream Patches:
3.x: https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892 4.0.x: https://github.com/jupyter/notebook/commit/dd9876381f0ef09873d8c5f6f2063269172331e3 4.x: https://github.com/jupyter/notebook/commit/35f32dd2da804d108a3a3585b69ec3295b2677ed
Other sources
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-6938?
CVE-2015-6938 has a medium severity level due to its potential for Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2015-6938?
To fix CVE-2015-6938, upgrade IPython to version 4.0.5 or later, or ensure that the notebook software is updated to version 4.0.5.
What systems are affected by CVE-2015-6938?
CVE-2015-6938 affects IPython versions up to 4.0.4 and Jupyter Notebook versions up to 4.0.4.
What kind of attack does CVE-2015-6938 enable?
CVE-2015-6938 enables Cross-Site Scripting (XSS) attacks by allowing unescaped local folder names in HTML templates.
Who reported CVE-2015-6938?
CVE-2015-6938 was reported by security researchers concerned with vulnerabilities in IPython's notebook handling.