High severity · published Mar 31, 2022
CVE-2022-24758
The Jupyter notebook is a web-based notebook environment for interactive computing
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter notebook version 6.4.x contains a patch for this issue. There are currently no known workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Notebook · Jupyter
before 6.4.10 · source: NVD
Affected product
NO
Notebook
Jupyter
More from Notebook
9.6
CVE-2026-42557
jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content
9.6
CVE-2021-32798
The Jupyter notebook is a web-based notebook environment for interactive computing
8.4
CVE-2026-40171
Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker
7.8
CVE-2018-8768
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context
6.5
CVE-2024-22421
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture