The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access to the Windows machine hosting the Jupyter server, or access other network-accessible machines or 3rd party services using that credential. Or an attacker perform an NTLM relay attack without cracking the credential to gain access to other network-accessible machines. This vulnerability is fixed in 2.14.1.
References
Configurations
Configuration 1 (hide)
| AND |
|
History
24 Oct 2024, 19:22
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/jupyter-server/jupyter_server/commit/79fbf801c5908f4d1d9bc90004b74cfaaeeed2df - Patch | |
| References | () https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-hrw6-wg82-cm62 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Microsoft windows
Microsoft Jupyter jupyter Server Jupyter |
|
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* cpe:2.3:a:jupyter:jupyter_server:*:*:*:*:*:*:*:* |
06 Jun 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-06 16:15
Updated : 2024-10-24 19:22
NVD link : CVE-2024-35178
Mitre link : CVE-2024-35178
JSON object : View
Products Affected
jupyter
- jupyter_server
microsoft
- windows
CWE