CVE search · CVE-2014-3429
CVE-2014-3429
medium 6.8
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-94
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 2.0 | medium 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
References
- http://advisories.mageia.org/MGASA-2014-0320.htmlThird Party Advisory
- http://lambdaops.com/cross-origin-websocket-hijacking-of-ipythonPress/Media CoverageTechnical Description
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.htmlThird Party Advisory
- http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198Broken Link
- http://seclists.org/oss-sec/2014/q3/152Third Party AdvisoryVDB Entry
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:160Broken Link
- https://bugzilla.redhat.com/show_bug.cgi?id=1119890Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94497
- https://github.com/ipython/ipython/pull/4845Issue TrackingPatch
- http://advisories.mageia.org/MGASA-2014-0320.htmlThird Party Advisory
- http://lambdaops.com/cross-origin-websocket-hijacking-of-ipythonPress/Media CoverageTechnical Description
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.htmlThird Party Advisory
- http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198Broken Link
- http://seclists.org/oss-sec/2014/q3/152Third Party AdvisoryVDB Entry
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:160Broken Link
- https://bugzilla.redhat.com/show_bug.cgi?id=1119890Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94497
- https://github.com/ipython/ipython/pull/4845Issue TrackingPatch