CVE-2015-4707 - Vulnerability Details - OpenCVE

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00811.

Key SSVC decision points have not yet been added.

Vendors	Products
Ipython	Ipython

Configuration 1 [-]

cpe:2.3:a:ipython:ipython:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2017-0063	Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.
Github GHSA	GHSA-66gw-5xpf-gfp5	Improper Neutralization of Input During Web Page Generation in IPython

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2015/06/22/7
http://www.securityfocus.com/bid/75328
https://bugzilla.redhat.com/show_bug.cgi?id=1235688
https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfce
https://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549c
https://ipython.org/ipython-doc/3/whatsnew/version3.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-09-20T18:00:00

Updated: 2024-08-06T06:25:20.163Z

Reserved: 2015-06-22T00:00:00

Link: CVE-2015-4707

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-09-20T18:29:00.890

Modified: 2025-04-20T01:37:25.860

Link: CVE-2015-4707

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-06-22T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-26T09:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://ipython.org/ipython-doc/3/whatsnew/version3.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfce"}, {"name": "[oss-security] 20150622 Re: CVE request: IPython XSS in JSON error responses", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2015/06/22/7"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549c"}, {"name": "75328", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/75328"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1235688"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-4707", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://ipython.org/ipython-doc/3/whatsnew/version3.html", "refsource": "CONFIRM", "url": "https://ipython.org/ipython-doc/3/whatsnew/version3.html"}, {"name": "https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfce", "refsource": "CONFIRM", "url": "https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfce"}, {"name": "[oss-security] 20150622 Re: CVE request: IPython XSS in JSON error responses", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2015/06/22/7"}, {"name": "https://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549c", "refsource": "CONFIRM", "url": "https://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549c"}, {"name": "75328", "refsource": "BID", "url": "http://www.securityfocus.com/bid/75328"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1235688", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1235688"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T06:25:20.163Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://ipython.org/ipython-doc/3/whatsnew/version3.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfce"}, {"name": "[oss-security] 20150622 Re: CVE request: IPython XSS in JSON error responses", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2015/06/22/7"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549c"}, {"name": "75328", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/75328"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1235688"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-4707", "datePublished": "2017-09-20T18:00:00", "dateReserved": "2015-06-22T00:00:00", "dateUpdated": "2024-08-06T06:25:20.163Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ipython:ipython:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F259122-2E9B-4C97-B15B-C508F6E88033", "versionEndExcluding": "3.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path."}, {"lang": "es", "value": "Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en IPython en versiones anteriores a la 3.2 permite que atacantes remotos inyecten scripts web o HTML mediante vectores relacionados con mensajes de error JSON y la ruta /api/notebooks."}], "id": "CVE-2015-4707", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-09-20T18:29:00.890", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2015/06/22/7"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/75328"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1235688"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfce"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549c"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://ipython.org/ipython-doc/3/whatsnew/version3.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2015/06/22/7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/75328"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1235688"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfce"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://ipython.org/ipython-doc/3/whatsnew/version3.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}