Unscored severity · published Aug 7, 2014
CVE-2014-3429
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of…
–
CVSS
4.7%
EPSS
No
On KEV
Description
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Ipython Notebook · Ipython
0.12; 0.12.1; 0.13; 0.13.1; 0.13.2; 1.0.0; +1 more · source: NVD
MA
Mageia · Mageia
3.0; 4.0 · source: NVD
OP
Opensuse · Opensuse
13.1; 13.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3429
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3429
Third Party Advisory
http://advisories.mageia.org/MGASA-2014-0320.html
Press/Media Coverage
http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.html
Broken Link
http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198
Third Party Advisory
http://seclists.org/oss-sec/2014/q3/152
Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2015:160