CVE-2023-49080
Information Disclosure vulnerability in jupyter-server

Information Disclosure No known exploit

What is CVE-2023-49080 About?

This vulnerability in jupyter-server causes traceback information, including path details, to be exposed in unhandled API request errors. While requiring authentication, it allows authenticated users to obtain potentially sensitive system path information. Exploitation is limited to already authenticated users.

Affected Software

  • jupyter-server
    • <2.11.2
    • <0056c3aa52cbb28b263a7a609ae5f17618b36652

Technical Details

The vulnerability stems from the jupyter-server's handling of errors in API requests. When an unhandled error occurs during an API request, the server includes detailed traceback information in its JSON error responses. This traceback can inadvertently reveal sensitive system path information, such as directories or file structures. Although the vulnerability requires authentication to trigger, meaning an attacker must already have legitimate access to the system, the disclosure of internal path information can still be valuable for further reconnaissance within the environment.

What is the Impact of CVE-2023-49080?

Successful exploitation may allow attackers to gain specific information about the system's internal structure and file paths, which could aid in subsequent, more targeted attacks.

What is the Exploitability of CVE-2023-49080?

Exploitation requires the attacker to be authenticated, as the vulnerability cannot be triggered without authentication. The complexity is low for an authenticated user, simply requiring them to trigger an unhandled error in an API request. This is likely a remote exploit, assuming API access is available remotely. The privileges required are those of an authenticated user. The primary risk factor is that if an attacker has already gained user-level access, this vulnerability provides additional system information that could be leveraged for privilege escalation or further compromise. No special conditions beyond authentication are mentioned.

What are the Known Public Exploits?

PoC Author Link Commentary
No known exploits

What are the Available Fixes for CVE-2023-49080?

Available Upgrade Options

  • jupyter-server
    • <2.11.2 → Upgrade to 2.11.2
  • jupyter-server
    • <0056c3aa52cbb28b263a7a609ae5f17618b36652 → Upgrade to 0056c3aa52cbb28b263a7a609ae5f17618b36652

Struggling with dependency upgrades?

See how Resolved Security's drop-in replacements make it simple.

Book a demo

Additional Resources

What are Similar Vulnerabilities to CVE-2023-49080?

Similar Vulnerabilities: CVE-2023-37659 , CVE-2023-35805 , CVE-2023-30626 , CVE-2022-4881 , CVE-2022-21657

All Rights reserved 2025
Privacy Policy