Jupyter nbgrader 0.9.4 exposure of resource

Summaryinfo

A vulnerability labeled as problematic has been found in Jupyter nbgrader 0.9.4. This affects an unknown function. Executing a manipulation can lead to exposure of resource. This vulnerability appears as CVE-2025-23205. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Jupyter nbgrader 0.9.4. It has been declared as problematic. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a exposure of resource vulnerability. The CWE definition for the vulnerability is CWE-668. The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. As an impact it is known to affect confidentiality. CVE summarizes:

nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of `enable_subdomains = False`. #1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice's page is on the same Origin as the formgrader iframe, Javasript on Alice's page has _full access_ to the contents of the page served by formgrader using Bob's credentials. This issue has been addressed in release 0.9.5 and all users are advised to upgrade. Users unable to upgrade may disable `frame-ancestors: self`, or enable per-user and per-service subdomains with `JupyterHub.enable_subdomains = True` (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame).

The advisory is available at github.com. This vulnerability was named CVE-2025-23205 since 01/13/2025. The exploitation appears to be easy. The attack can be initiated remotely. The technical details are unknown and an exploit is not available.

Upgrading to version 0.9.5 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Jupyter

Name

• nbgrader

Version

• 0.9.4

Website

• Product: https://github.com/jupyter/nbgrader/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion