CVE-2021-32798

Description

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

Risk Information

Base Score

9.6

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.226

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.1	Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.2	Windows
Vulnerabilities CVE-2021-32797,CVE-2021-32798 are fixed in Python-notebook 5.7.11	Windows
Vulnerabilities CVE-2021-32797,CVE-2021-32798 are fixed in Python-notebook 6.4.1	Windows
Vulnerabilities CVE-2021-32797,CVE-2021-32798 are fixed in Python-notebook for linux 5.7.11	Linux
Vulnerabilities CVE-2021-32797,CVE-2021-32798 are fixed in Python-notebook for linux 6.4.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234