GitHub Advisoryadvisory · PyPI
GHSA-hrw6-wg82-cm62 Jupyter server on Windows discloses Windows user password hash
HIGH
Official page ↗
- Aliases
- CVE-2024-35178
- Ecosystem
- PyPI
- Packages
- jupyter_server
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2024-06-06
Affected packages
• PyPI jupyter_server: < 2.14.1 → fixed in 2.14.1
Description
Summary
Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access to the Windows machine hosting the Jupyter server, or access other network-accessible machines or 3rd party services using that credential. Or an attacker perform an NTLM relay attack without cracking the credential to gain access to other network-accessible machines.
Related
Alias · CVE (1)
- CVE-2024-35178 The Jupyter Server provides the backend for Jupyter web applications. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-hrw6-wg82-cm62 web
- https://nvd.nist.gov/vuln/detail/CVE-2024-35178 advisory
- https://github.com/jupyter-server/jupyter_server/commit/79fbf801c5908f4d1d9bc90004b74cfaaeeed2df web
- https://github.com/jupyter-server/jupyter_server package
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2024-165.yaml web