Fluid Attacks Database

Description

Improper Neutralization of Input During Web Page Generation in IPython Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
pypi	ipython	>=0 <3.2.0	3.2.0
debian 12	ipython	>=0 <2.4.1-1	2.4.1-1
debian 11	ipython	>=0 <2.4.1-1	2.4.1-1
debian 13	ipython	>=0 <2.4.1-1	2.4.1-1
debian 14	ipython	>=0 <2.4.1-1	2.4.1-1

Aliases

1. CVE-2015-47072. NVD-2015-47073. OSV-2015-47074. OSV-DEBIAN-2015-47075. GHSA-66gw-5xpf-gfp56. GCVE-2015-47077. SECURITY-TRACKER-CVE-2015-4707

References

1. https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfce2. https://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549c3. https://bugzilla.redhat.com/show_bug.cgi?id=12356884. https://github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2017-46.yaml5. https://ipython.org/ipython-doc/3/whatsnew/version3.html6. https://web.archive.org/web/20200227150022/https://www.securityfocus.com/bid/753287. http://www.openwall.com/lists/oss-security/2015/06/22/7

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.