CVE-2015-4706: ipython Cross-site Scripting

EPSS trend

Probability

2.10%

Chance of exploitation in the next 30 days

Percentile

81%

Versus all other CVEs

30-day change

0.00 pp

From 2.10% on 20-09-2026

20-09-202620-10-2026

EPSS score

2.10%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

11 links

ipython.org/ipython-doc/3/whatsnew/version3.htmlX Refsource CONFIRMRelease NotesVendor AdvisoryWEB
github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfceX Refsource CONFIRMPatchThird Party AdvisoryWEBFIX
www.openwall.com/lists/oss-security/2015/06/22/7Mailing ListX Refsource MLISTThird Party AdvisoryWEB
github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549cX Refsource CONFIRMPatchThird Party AdvisoryWEBFIX
www.securityfocus.com/bid/75328VDB EntryX Refsource BIDThird Party AdvisoryWEB
bugzilla.redhat.com/show_bug.cgi?id=1235688X Refsource CONFIRMIssue TrackingThird Party AdvisoryVDB EntryWEBREPORT
nvd.nist.gov/vuln/detail/CVE-2015-4706Advisory
github.com/advisories/GHSA-q326-jhw3-699gAdvisory
github.com/ipython/ipythonPACKAGE
github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2017-45.yamlWEB

Show all 11 references

web.archive.org/web/20200516112656/http://www.securityfocus.com/bid/75328WEB

Related vulnerabilities

CVE-2015-4707debianipython+32.27%9y ago20-09-2017 18:00Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.CVE-2015-5607debianipython+41.21%9y ago20-09-2017 16:00Cross-site request forgery in the REST API in IPython 2 and 3.CVE-2022-21699chainguardkubeflow-pipelines-visualization-server+130.65%4y ago19-01-2022 21:15IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.CVE-2023-24816chainguardkubeflow-pipelines-visualization-server+41.31%3y ago10-02-2023 19:52IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function `IPython.utils.terminal.set_term_title` be called on Windows in a Python environment where ctypes is not available. The dependency on `ctypes` in `IPython.utils._process_win32` prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool `set_term_title` could be called and hence introduce a vulnerability. Should an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. Users of ipython as a library are advised to upgrade. Users unable to upgrade should ensure that any calls to the `IPython.utils.terminal.set_term_title` function are done with trusted or filtered input.

All vulnerabilities inipython

CVE-2015-4706: ipython Cross-site Scripting

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References