{"id":"CVE-2018-19352","published":"2018-11-18T17:00:00Z","modified":"2024-08-05T11:37:10Z","title":"Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js…","vendor":null,"product":null,"tier":"tail","description":{"text":"Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01335,"percentile":0.71076,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/jupyter/notebook/commit/288b73e1edbf527740e273fcc69b889460871648","tags":["x_refsource_MISC"]},{"url":"https://pypi.org/project/notebook/#history","tags":["x_refsource_MISC"]},{"url":"https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst","tags":["x_refsource_MISC"]}],"priority":{"score":14.2,"factors":[{"name":"EPSS percentile","points":14.22}]},"affected":[{"ecosystem":"PyPI","package":"notebook","vulnerableRanges":["<5.7.2"],"patched":["5.7.2"],"from":["GHSA-3p4q-x8f3-p7vq","PYSEC-2018-18"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0105","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ipython-cve-2015-7337","parents":[{"from":"CVE-2015-7337","to":"CVE-2018-19352","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["notebook/static/tree/js/notebooklist.js"],"commits":["https://github.com/jupyter/notebook/commit/9e63dd89b603dfbe3a7e774d8a962ee0fa30c0b5","https://github.com/jupyter/notebook/commit/288b73e1edbf527740e273fcc69b889460871648"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2018-8768","published":"2018-03-18","fixed":"5.4.1","kev":false},{"cve":"CVE-2018-21030","published":"2019-10-31","fixed":"5.5.0","kev":false},{"cve":"CVE-2018-19351","published":"2018-11-18","fixed":"5.7.1","kev":false,"link":{"from":"CVE-2018-19351","to":"CVE-2018-19352","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:notebook","fromFixed":"5.7.1","toFixed":"5.7.2","daysApart":0}]}},{"cve":"CVE-2018-19352","published":"2018-11-18","fixed":"5.7.2","kev":false},{"cve":"CVE-2019-9644","published":"2019-03-12","fixed":"5.7.6","kev":false,"link":{"from":"CVE-2018-19352","to":"CVE-2019-9644","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:notebook","fromFixed":"5.7.2","toFixed":"5.7.6","daysApart":114}]}},{"cve":"CVE-2019-10255","published":"2019-03-28","fixed":"5.7.8","kev":false},{"cve":"CVE-2019-10856","published":"2019-04-04","fixed":"5.7.8","kev":false}],"package":"PyPI:notebook"}}