{
  "cveId": "CVE-2023-40170",
  "url": "https://patchblox.com/security/cve/CVE-2023-40170",
  "summary": "CVE-2023-40170 is fixed in jupyter-server on 1 platform, first by DEBIAN-CVE-2023-40170, released August 28, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "jupyter-server: jupyter-server is the backend for Jupyter web applications",
  "description": "jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on \u0060/files/\u0060 URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via  \u0022Open image in new tab\u0022. This issue has been addressed in commit \u006087a49272728\u0060 which has been included in release \u00602.7.2\u0060. Users are advised to upgrade. Users unable to upgrade may use the lower performance \u0060--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler\u0060, which implements the correct checks.",
  "published": "2023-08-28T21:15:07Z",
  "severity": "medium",
  "cvss": 6.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "epss": 0.00623,
  "epssPercentile": 0.5015,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "jupyter-server",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.14.2-1",
      "fix": "DEBIAN-CVE-2023-40170",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-40170",
      "released": "2023-08-28T21:15:07Z"
    },
    {
      "platform": "linux",
      "product": "jupyter-server",
      "release": "Debian 14",
      "fixedVersion": "2.14.2-1",
      "fix": "DEBIAN-CVE-2023-40170",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-40170",
      "released": "2023-08-28T21:15:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}