Cross-site Request Forgery (CSRF) Affecting notebook package, versions [,4.3.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-NOTEBOOK-40449
- published 13 Dec 2016
- disclosed 13 Dec 2016
- credit Unknown
Introduced: 13 Dec 2016
CVE-2016-9971 Open this link in a new tabOverview
notebook is a web-based notebook environment for interactive computing.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) attacks due to improper validation of the CSRF token. A malicious user may be able to spawn new kernels and create empty, untitled files on the user's notebook server.
Note: This affects users of Firefox or Microsoft (IE, Edge) browsers, and any other browsers that do not set the Origin header on cross-site forms. WebKit and Blink based browsers like Safari and Chrome are not affected.
References
CVSS Scores
version 3.1