Information Exposure Affecting jupyter-server package, versions [,2.14.1)
Threat Intelligence
EPSS
0.09% (39th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-JUPYTERSERVER-7217832
- published 7 Jun 2024
- disclosed 6 Jun 2024
- credit nvn1729
Introduced: 6 Jun 2024
CVE-2024-35178 Open this link in a new tabHow to fix?
Upgrade jupyter-server to version 2.14.1 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure through the NTLMv2 password hash exposure process. An attacker can obtain and potentially crack this hash to gain unauthorized access to the Windows machine hosting the server or to other network-accessible machines or third-party services using the same credentials.
References
CVSS Scores
version 3.1