| Vulnerability Name: | CVE-2014-3429 (CCN-94497) | ||||||||||||||||
| Assigned: | 2014-07-15 | ||||||||||||||||
| Published: | 2014-07-15 | ||||||||||||||||
| Updated: | 2018-10-30 | ||||||||||||||||
| Summary: | IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page. | ||||||||||||||||
| CVSS v3 Severity: | 5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
| ||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P) 5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
4.8 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||||||||||
| Vulnerability Type: | CWE-94 | ||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||
| References: | Source: CONFIRM Type: Third Party Advisory http://advisories.mageia.org/MGASA-2014-0320.html Source: MITRE Type: CNA CVE-2014-3429 Source: CONFIRM Type: Press/Media Coverage, Technical Description http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython Source: SUSE Type: Third Party Advisory openSUSE-SU-2014:1060 Source: MLIST Type: Broken Link [ipython-dev] 20140713 Vulnerability in IPython Notebook ≤ 1.1 Source: CCN Type: oss-security Mailing List, Tue, 15 Jul 2014 03:38:27 -0600 IPython Notebook Cross 2014-3429 Source: MLIST Type: Third Party Advisory, VDB Entry [oss-security] 20140715 IPython Notebook Cross 2014-3429 Source: MANDRIVA Type: Broken Link MDVSA-2015:160 Source: CCN Type: BID-68680 IPython Notebook Websocket Hijacking Remote Code Execution Vulnerability Source: CCN Type: Red Hat Bugzilla Bug 1119890 (CVE-2014-3429) CVE-2014-3429 ipython: cross-domain websocket hijacking vulnerability Source: CONFIRM Type: Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1119890 Source: XF Type: UNKNOWN ipython-cve20143429-code-exec(94497) Source: XF Type: UNKNOWN ipython-cve20143429-code-exec(94497) Source: CCN Type: ipython GIT Repository ipython Source: CONFIRM Type: Issue Tracking, Patch https://github.com/ipython/ipython/pull/4845 Source: CCN Type: WhiteSource Vulnerability Database CVE-2014-3429 | ||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3:  Denotes that component is vulnerable | ||||||||||||||||
| Oval Definitions | |||||||||||||||||
| |||||||||||||||||
| BACK | |||||||||||||||||