Skip to content
Fencer Vulns
medium 4.3

CVE-2022-29238 json

Forced Browsing in Jupyter Notebook

published 2022-06-14 4 y ago modified 2026-09-08 2 mo ago also BIT-jupyter-base-notebook-2022-29238 , BIT-jupyter-notebook-2022-29238 , EUVD-2022-0164 , GHSA-v7vq-3x77-87vg , PYSEC-2022-212

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook configurations allowing authenticated access to files that may reasonably be expected to be disallowed. Because fully authenticated requests are required, this is of relatively low impact. But if a server's root directory contains sensitive files whose only protection from the server is being hidden (e.g. `~/.ssh` while serving $HOME), then any authenticated requests could access files if their names are guessable. Such contexts also necessarily have full access to the server and therefore execution permissions, which also generally grants access to all the same files. So this does not generally result in any privilege escalation or increase in information access, only an additional, unintended means by which the files could be accessed. Version 6.4.12 contains a patch for this issue. There are currently no known workarounds.

Patch / fix

  • pypi notebook 6.4.12
  • bitnami jupyter-base-notebook 6.4.12
  • bitnami jupyter-notebook 6.4.12
  • jupyter notebook 6.4.12
  • jupyter-notebook Debian 14, Debian 13, Debian 12 6.4.12-1

debian advisories DEBIAN-CVE-2022-29238

  • jupyter-notebook Ubuntu 20.04 LTS 6.0.3-2ubuntu0.1
  • jupyter-notebook Ubuntu 22.04 LTS 6.4.8-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2022-29238

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • jupyter-notebook Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 6.4.12-r0

alpine advisories ALPINE-CVE-2022-29238

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
OSV 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi notebook
<6.4.12
6.4.12
bitnami jupyter-base-notebook
<6.4.12
6.4.12
bitnami jupyter-notebook
<6.4.12
6.4.12

Affected products

  • jupyter notebook

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.