GHSA-44cc-43rp-5947

    Dashboard / Vulnerabilities / GHSA-44cc-43rp-5947

    GHSA-44cc-43rp-5947

    Published: 19 Jan 2024Last Modified: 10 Sept 2026

    Summary: JupyterLab vulnerable to potential authentication and CSRF tokens leak

    Details: ### Impact Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. ### Patches JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched. ### Workarounds No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix. ### References Vulnerability reported by user @davwwwx via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).

    References: https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947, https://nvd.nist.gov/vuln/detail/CVE-2024-22421, https://github.com/jupyterlab/jupyterlab/commit/19bd9b96cb2e77170a67e43121637d0b5619e8c6, https://github.com/jupyterlab/jupyterlab/commit/1ef7a4fa0202ebdf663e1cc0b45c8813a34a0b96, https://github.com/jupyterlab/jupyterlab/commit/fccd83dc4441da0384ee3fd1322c3b2d9ad4caaa, https://github.com/jupyterlab/jupyterlab, https://lists.fedoraproject.org/archives/list/[email protected]/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H

    Affected packages

    Package

    Name: jupyterlab

    Purl: pkg:pypi/jupyterlab

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 4.0.0
    Fixed -4.0.11

    Affected versions

    4.0.0
    4.0.1
    4.0.10
    4.0.2
    4.0.3
    4.0.4
    4.0.5
    4.0.6
    4.0.7
    4.0.8
    4.0.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-44cc-43rp-5947 | CVE-DB