CVE-2018-21030: XSS

Q: What is CVE-2018-21030?

CVE-2018-21030 is a vulnerability in Jupyter Notebook before version 5.5.0 that allows an attacker to place an XSS payload in an SVG document.

Q: How does CVE-2018-21030 work?

CVE-2018-21030 occurs because Jupyter Notebook does not use a Content Security Policy (CSP) header, allowing served files to be treated as belonging to the same origin, which can be exploited to execute malicious scripts.

Q: How severe is CVE-2018-21030?

CVE-2018-21030 has a severity rating of 5.3, which is considered medium.

Q: How can I fix CVE-2018-21030?

To fix CVE-2018-21030, upgrade Jupyter Notebook to version 5.5.0 or newer.

Q: Where can I find more information about CVE-2018-21030?

More information about CVE-2018-21030 can be found at the following references: [link1], [link2], [link3].

Published Oct 31, 2019

Updated

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.

Affected Software

2 affected componentsFixes available

jupyter notebook<5.5.0

pip/notebook<5.5.0rc1

5.5.0rc1

Remediation

Patch Available

https://github.com/jupyter/notebook/pull/3341

Event History

Oct 31, 2019

CVE Published

via MITRE·02:52 PM

Data Sourced

via MITRE·02:52 PM

Description

Nov 8, 2019

Advisory Published

via GitHub·05:07 PM

Frequently Asked Questions

What is CVE-2018-21030?

CVE-2018-21030 is a vulnerability in Jupyter Notebook before version 5.5.0 that allows an attacker to place an XSS payload in an SVG document.

How does CVE-2018-21030 work?

CVE-2018-21030 occurs because Jupyter Notebook does not use a Content Security Policy (CSP) header, allowing served files to be treated as belonging to the same origin, which can be exploited to execute malicious scripts.

How severe is CVE-2018-21030?