CVE-2018-21030 - Vulnerability Details - OpenCVE

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00368.

Key SSVC decision points have not yet been added.

Vendors	Products
Jupyter	Notebook

Configuration 1 [-]

cpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
Debian DLA	DLA-2432-1	jupyter-notebook security update
EUVD	EUVD-2019-0093	Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.
Github GHSA	GHSA-jqwc-jm56-wcwj	Cross-site scripting in Jupyter Notebook
Ubuntu USN	USN-5585-1	Jupyter Notebook vulnerabilities

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/jupyter/notebook/pull/3341
https://github.com/jupyter/notebook/releases/tag/5.5.0
https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-10-31T14:52:45

Updated: 2024-08-05T12:19:27.469Z

Reserved: 2019-10-31T00:00:00

Link: CVE-2018-21030

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-10-31T15:15:10.420

Modified: 2024-11-21T04:02:44.097

Link: CVE-2018-21030

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-11-19T06:06:11", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/jupyter/notebook/pull/3341"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/jupyter/notebook/releases/tag/5.5.0"}, {"name": "[debian-lts-announce] 20201119 [SECURITY] [DLA 2432-1] jupyter-notebook security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-21030", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/jupyter/notebook/pull/3341", "refsource": "MISC", "url": "https://github.com/jupyter/notebook/pull/3341"}, {"name": "https://github.com/jupyter/notebook/releases/tag/5.5.0", "refsource": "MISC", "url": "https://github.com/jupyter/notebook/releases/tag/5.5.0"}, {"name": "[debian-lts-announce] 20201119 [SECURITY] [DLA 2432-1] jupyter-notebook security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T12:19:27.469Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/jupyter/notebook/pull/3341"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/jupyter/notebook/releases/tag/5.5.0"}, {"name": "[debian-lts-announce] 20201119 [SECURITY] [DLA 2432-1] jupyter-notebook security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-21030", "datePublished": "2019-10-31T14:52:45", "dateReserved": "2019-10-31T00:00:00", "dateUpdated": "2024-08-05T12:19:27.469Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*", "matchCriteriaId": "05F1F7F5-ADFF-48B3-B02F-85CE8F53951C", "versionEndExcluding": "5.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document."}, {"lang": "es", "value": "Jupyter Notebook versiones anteriores a 5.5.0, no utiliza un encabezado CSP para tratar los archivos servidos como pertenecientes a un origen separado. As\u00ed, por ejemplo, se puede colocar una carga XSS en un documento SVG."}], "id": "CVE-2018-21030", "lastModified": "2024-11-21T04:02:44.097", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-10-31T15:15:10.420", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/jupyter/notebook/pull/3341"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/jupyter/notebook/releases/tag/5.5.0"}, {"source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/jupyter/notebook/pull/3341"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/jupyter/notebook/releases/tag/5.5.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}