CVE-2024-22421

mediumPriorität · verfolgen · 26EPSS 0.007 · 52. PerzentilEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.67% (52nd) EPSS

CVSS 6.5 · medium

Is it mine?

14 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · bewertet 2026-10-27

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.6

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6–7.6

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 3.6

v3.17.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · ENISA EU

v3.17.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · security-advisories@github.comAusnutzbarkeit 2.8 · Auswirkung 4.7

v3.17.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:Lsecondary · OSV

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-200USCWE-200USCWE-23US

betroffene Produkte (14)

Betroffene Produkte und Versionsbereiche.

jupyterlab jupyterlaballe Versionenenisa_euvdEU
jupyterlab jupyterlab≤ < 3.6.7enisa_euvdEU
jupyterlab jupyterlab≤ 4.0.0,< 4.0.11enisa_euvdEU
fedoraproject fedora= 39nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
jupyter jupyterlab< 3.6.7nvdUScpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:*
jupyter jupyterlab4.0.0 → 4.0.11nvdUScpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:*
jupyter notebook7.0.0 → 7.0.7nvdUScpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*
Bitnami jupyter-base-notebook7.0.0 → 7.0.7osvUSpkg:bitnami/jupyter-base-notebook
Bitnami jupyter-notebook7.0.0 → 7.0.7osvUSpkg:bitnami/jupyter-notebook
Bitnami jupyterlab< 3.6.7osvUSpkg:bitnami/jupyterlab
Bitnami jupyterlab4.0.0 → 4.0.11osvUSpkg:bitnami/jupyterlab
PyPI jupyterlab< 3.6.7osvUSpkg:pypi/jupyterlab
PyPI jupyterlab4.0.0 → 4.0.11osvUSpkg:pypi/jupyterlab
PyPI notebook7.0.0 → 7.0.7osvUSpkg:pypi/notebook

Advisories (6)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-44cc-43rp-5947JupyterLab vulnerable to potential authentication and CSRF tokens leak2024-01-19ghsa · osvUS
### Impact Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. ### Patches JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched. ### Workarounds No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix. ### References Vulnerability reported by user @davwwwx via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).
BIT-jupyter-base-notebook-2024-22421Potential authentication and CSRF tokens leak in JupyterLab2024-03-06vendor · osvUS
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.
BIT-jupyter-notebook-2024-22421Potential authentication and CSRF tokens leak in JupyterLab2024-03-06vendor · osvUS
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.
BIT-jupyterlab-2024-22421Potential authentication and CSRF tokens leak in JupyterLab2024-03-06vendor · osvUS
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.
PYSEC-2026-1706JupyterLab vulnerable to potential authentication and CSRF tokens leak2026-07-07vendor · osvUS
### Impact Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. ### Patches JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched. ### Workarounds No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix. ### References Vulnerability reported by user @davwwwx via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).
PYSEC-2026-2534JupyterLab vulnerable to potential authentication and CSRF tokens leak2026-07-13vendor · osvUS
### Impact Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. ### Patches JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched. ### Workarounds No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix. ### References Vulnerability reported by user @davwwwx via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).

auch bekannt als (11)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

veröffentlicht 2024-01-19geändert 2026-06-17

Referenzen (10)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan