CVE-2024-28233 json
XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing
published 2024-03-27 2 y ago modified 2026-09-10 59 d ago also BIT-jupyterhub-2024-28233 , EUVD-2024-0861 , GHSA-7r3h-4ph8-w38g , PYSEC-2026-1480
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API and user's single-user server. The affected configurations are single-origin JupyterHub deployments and JupyterHub deployments with user-controlled applications running on subdomains or peer subdomains of either the Hub or a single-user server. This vulnerability is fixed in 4.1.0.
Patch / fix
- pypi jupyterhub 4.1.0
- bitnami jupyterhub 4.1.0
- jupyterhub jupyterhub 4.1.0
- jupyterhub Debian 14, Debian 13 5.0.0+ds1-1
debian advisories DEBIAN-CVE-2024-28233
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | jupyterhub | <4.1.0 |
4.1.0 |
| bitnami | jupyterhub | <4.1.0 |
4.1.0 |
Affected products
- jupyterhub jupyterhub
Classification
References
-
github.com
/jupyterhub/jupyterhub/commit/e2798a088f5ad45340fe79cdf1386198e664f77f
web, patch
-
github.com
/jupyterhub/jupyterhub/security/advisories/GHSA-7r3h-4ph8-w38g
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-28233
advisory, web
-
github.com
/jupyterhub/jupyterhub
package
-
pypi.org
/project/jupyterhub
package
-
github.com
/advisories/GHSA-7r3h-4ph8-w38g
advisory
Sources
- CVE List CVE-2024-28233
- GitHub Advisory GHSA-7r3h-4ph8-w38g
- NVD CVE-2024-28233
- OSV BIT-jupyterhub-2024-28233
- OSV PYSEC-2026-1480
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.