CVE-2022-24757: jupyter-server jupyter_server
Vulnerability summary
CVE-2022-24757 is a high (CVSS 7.5) vulnerability in jupyter-server jupyter_server. EPSS estimates a 1.27% chance of exploitation in the next 30 days, higher than 69.3% of scored vulnerabilities.
Timeline
- 23-03-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter Server version 1.15.4 contains a patch for this issue. There are currently no known workarounds.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.27%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
0.00 pp
From 1.27% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- jupyter-server< 1.16.0-1
Jupyter1 product
- jupyter_server< 1.15.4
Jupyter-server1 product
- jupyter_server< 1.15.4
PyPI1 product
- jupyter-server< a5683aca0b0e412672ac6218d09f74d44ca0de5a | < 1.15.4
Ubuntu1 product
- jupyter-serverAll versions (No fix recorded)
5 vendors · 5 products
References
8 links- github.com/jupyter-server/jupyter_server/security/advisories/GHSA-p737-p57g-4cprX Refsource CONFIRMWEBAdvisoryREPORTThird Party Advisory
- github.com/jupyter-server/jupyter_server/commit/a5683aca0b0e412672ac6218d09f74d44ca0de5aX Refsource MISCWEBFIXREPORTPatchThird Party Advisory
