TI-2024-23252 Aliases CVE-2024-35178 GHSA-hrw6-wg82-cm62

Jupyter server on Windows discloses Windows user password hash

MEDIUM 42CWE-200Published 2024-06-06 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access to the Windows machine hosting the Jupyter server, or access other network-accessible machines or 3rd party services using that credential. Or an attacker perform an NTLM relay attack without cracking the credential to gain access to other network-accessible machines. This vulnerability is fixed in 2.14.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00804 56th percentileScored 2026-11-07

Fix Fixed jupyter_server (jupyter-server): 2.14.1jupyter_server (PyPI): 2.14.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jupyterlab	jupyter_server	before 2.14.1	2.14.1	Patch available	CNA
—	jupyter_server (PyPI)	before 2.14.1	2.14.1	Patch available	GHSA-hrw6-wg82-cm62

jupyter_server Vendorjupyterlab Affected before 2.14.1 Fixed in 2.14.1 Patch available CNA
jupyter_server (PyPI) Vendor— Affected before 2.14.1 Fixed in 2.14.1 Patch available GHSA-hrw6-wg82-cm62

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:jupyter:jupyter_server::::::::	before 2.14.1	Vulnerable	jupyterlab
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:jupyter:jupyter_server:*:*:*:*:*:*:*:* Versions before 2.14.1 Vulnerable ·jupyterlab
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA jupyter_server (jupyter-server) Fixed in 2.14.1
Fix · GHSA-hrw6-wg82-cm62 jupyter_server (PyPI) Fixed in 2.14.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2024-35178
2026-10-03 Alias added: GHSA-hrw6-wg82-cm62

References

Patch 1

https://github.com/jupyter-server/jupyter_server/commit/79fbf801c5908f4d1d9bc90004b74cfaaeeed2df

Advisory 2

Other 2

TI-2026-05842 CORS Origin Validation Bypass in jupyter-server CVSS 3.1HIGH 8.8
TI-2026-04748 Path Traversal in jupyter/jupyter CVSS 3.1HIGH 8.1
TI-2026-27533 jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix CVSS 4.0HIGH 7.6
TI-2025-38102 jupyter_server next parameter open redirect can redirect users to external domains CVSS 4.0MEDIUM 6.3
TI-2026-32614 Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP CVSS 4.0CRITICAL 9.3
TI-2022-11782 Known or guessable hidden files may be accessed in Jupyter Server CVSS 3.1HIGH 8.8

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences