CVE-2015-7337: Input Validation
A vulnerability in IPython allowing maliciously forged file to be opened for editing that could execute javascript code, specifically by being redirected to /files/ due to the mistakenly treating the file as plain text. Versions >= 3.0 and <= 3.2.1 of IPython are affected.
Upstream patch:
https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967
CVE request:
http://seclists.org/oss-sec/2015/q3/558
Other sources
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7337?
CVE-2015-7337 is considered a moderate severity vulnerability that allows for the execution of JavaScript code through a maliciously forged file.
How do I fix CVE-2015-7337?
To fix CVE-2015-7337, upgrade your IPython to version 3.2.2 or later or your Jupyter Notebook to version 4.0.5 or later.
Which versions are affected by CVE-2015-7337?
CVE-2015-7337 affects IPython versions 3.0 through 3.2.1 and specific versions of Jupyter Notebook from 4.0.0 to 4.0.4.
Can CVE-2015-7337 be exploited without user interaction?
Yes, CVE-2015-7337 can be exploited without user interaction if a user opens a maliciously crafted file.
What type of attack is CVE-2015-7337 associated with?
CVE-2015-7337 is associated with file handling vulnerabilities that could lead to cross-site scripting (XSS) attacks.