CVE - CVE-2015-6938

CVE-ID
CVE-2015-6938	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=1259405 CONFIRM:https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892 CONFIRM:https://github.com/jupyter/notebook/commit/35f32dd2da804d108a3a3585b69ec3295b2677ed CONFIRM:https://github.com/jupyter/notebook/commit/dd9876381f0ef09873d8c5f6f2063269172331e3 FEDORA:FEDORA-2015-14901 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166471.html FEDORA:FEDORA-2015-14902 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166460.html FEDORA:FEDORA-2015-16128 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167670.html MLIST:[oss-security] 20150902 CVE Request : CSRF in IPython/Jupyter notebook Tree. URL:http://seclists.org/oss-sec/2015/q3/474 MLIST:[oss-security] 20150914 Re: CVE Request : CSRF in IPython/Jupyter notebook Tree. URL:http://seclists.org/oss-sec/2015/q3/544 SUSE:openSUSE-SU-2015:1699 URL:http://lists.opensuse.org/opensuse-updates/2015-10/msg00016.html
Assigning CNA
MITRE Corporation
Date Record Created
20150914	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20150914)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)