CVE-2015-6938: fedoraproject fedora Cross-site Scripting
Vulnerability summary
CVE-2015-6938 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in fedoraproject fedora. EPSS estimates a 2.79% chance of exploitation in the next 30 days, higher than 86.2% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 21-09-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
2.79%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.79% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundIpython
Maturity: poc
Notebook
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Mageia2 products
- ipython< 2.3.0-1.2.mga4
- ipython< 2.3.0-2.3.mga5
PyPI2 products
- ipython< 3ab41641cf6fce3860c73d5cf4645aa12e1e5892 | < 3.2.2
- notebook< dd9876381f0ef09873d8c5f6f2063269172331e3 | ≥ 4.0.0, < 4.0.5
Debian1 product
- ipython< 2.4.1-1
Fedoraproject1 product
- fedoraEOL21 | 22 | 23
Ipython1 product
- notebook≤ 3.2.1
Jupyter1 product
- notebook4.0.0 | 4.0.1 | 4.0.2 | 4.0.3 | 4.0.4
Opensuse1 product
- opensuseEOL13.1 | 13.2
Ubuntu1 product
- ipython< 2.4.1-1 | < 5.5.0-1
8 vendors · 10 products
References
20 links- lists.opensuse.org/opensuse-updates/2015-10/msg00016.htmlVendor AdvisoryX Refsource SUSEThird Party AdvisoryWEB
- github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892X Refsource CONFIRMExploitWEBFIX
- github.com/jupyter/notebook/commit/dd9876381f0ef09873d8c5f6f2063269172331e3X Refsource CONFIRMIssue TrackingPatchWEBFIX
- lists.fedoraproject.org/pipermail/package-announce/2015-September/167670.htmlVendor AdvisoryX Refsource FEDORAThird Party AdvisoryWEB
- github.com/jupyter/notebook/commit/35f32dd2da804d108a3a3585b69ec3295b2677edX Refsource CONFIRMExploitWEBFIX
- lists.fedoraproject.org/pipermail/package-announce/2015-September/166471.htmlVendor AdvisoryX Refsource FEDORAThird Party AdvisoryWEB
- lists.fedoraproject.org/pipermail/package-announce/2015-September/166460.htmlVendor AdvisoryX Refsource FEDORAThird Party AdvisoryWEB
