Skip to main content

Jupyter CVE-2023-36018

CRITICAL
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)
2023-11-14 secure@microsoft.com
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Nov 14, 2023 - 18:15 nvd
CRITICAL 9.8

DescriptionNVD

Visual Studio Code Jupyter Extension Spoofing Vulnerability

AnalysisAI

Visual Studio Code Jupyter Extension Spoofing Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-359. Affected products include: Microsoft Jupyter.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2024-39700 CRITICAL POC
9.8 Jul 16

JupyterLab extension template is a `copier` template for JupyterLab extensions. Rated critical severity (CVSS 9.8), this

CVE-2021-32798 CRITICAL POC
9.6 Aug 09

The Jupyter notebook is a web-based notebook environment for interactive computing. Rated critical severity (CVSS 9.6),

CVE-2021-32797 CRITICAL POC
9.6 Aug 09

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. Rated cri

CVE-2026-86258 HIGH POC
8.2 Sep 06

Path traversal in Jupyter nbviewer through version 1.0.1 allows unauthenticated remote attackers to read files from sibl

CVE-2020-26275 MEDIUM POC
6.1 Dec 21

The Jupyter Server provides the backend (i.e. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitab

CVE-2019-10856 MEDIUM POC
6.1 Apr 04

In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. Rated medium severity (CVSS 6.1), this

CVE-2023-25574 CRITICAL
10.0 Feb 25

`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). Rated critical se

CVE-2024-28179 CRITICAL
9.8 Mar 20

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provi

CVE-2024-22415 CRITICAL
9.8 Jan 18

jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion +

CVE-2021-39159 CRITICAL
9.8 Aug 25

BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments

CVE-2024-29033 CRITICAL
9.1 Mar 20

OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's

CVE-2026-6657 HIGH
8.8 Jun 03

Origin validation bypass in Jupyter Server 1.12.0 through 2.17.0 lets remote attackers defeat CORS origin checks wheneve

Share

CVE-2023-36018 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy