{"id":"CVE-2023-40170","published":"2023-08-28T20:01:57Z","modified":"2025-02-13T17:03:25Z","title":"cross-site inclusion (XSSI) of files in jupyter-server","vendor":"jupyter-server","product":"jupyter_server","tier":"tail","description":{"text":"jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via  \"Open image in new tab\". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00623,"percentile":0.49908,"provenance":"source"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"},{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-64x5-55rw-9974","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/jupyter-server/jupyter_server/commit/87a4927272819f0b1cae1afa4c8c86ee2da002fd","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XDKQAWQN6SQTOVACZNXYKEHWQXGG4DOF/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRP7DNZYVOIA4ZB3U3ZWKTFZEPYWNGCQ/","tags":[]}],"priority":{"score":13.2,"factors":[{"name":"EPSS percentile","points":9.98},{"name":"CVSS severity","points":3.22}]},"vendorSlug":"jupyter-server","affectedVersions":[{"vendor":"jupyter-server","product":"jupyter_server","versions":["< 2.7.2"]}],"affected":[{"ecosystem":"PyPI","package":"jupyter-server","vulnerableRanges":["<2.7.2"],"patched":["2.7.2"],"from":["GHSA-64x5-55rw-9974","PYSEC-2023-157"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0103","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-29241","published":"2022-06-14","fixed":"2.0.0a1","kev":false},{"cve":"CVE-2026-114135","published":"2026-10-21","fixed":"2.6.0","kev":false},{"cve":"CVE-2023-39968","published":"2023-08-28","fixed":"2.7.2","kev":false},{"cve":"CVE-2023-40170","published":"2023-08-28","fixed":"2.7.2","kev":false},{"cve":"CVE-2023-49080","published":"2023-12-04","fixed":"2.11.2","kev":false,"link":{"from":"CVE-2023-40170","to":"CVE-2023-49080","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:jupyter-server","fromFixed":"2.7.2","toFixed":"2.11.2","daysApart":98}]}},{"cve":"CVE-2025-61669","published":"2026-05-05","fixed":"2.18.0","kev":false},{"cve":"CVE-2026-35397","published":"2026-05-05","fixed":"2.18.0","kev":false}],"package":"PyPI:jupyter-server"}}