CVE-2014-3429

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://advisories.mageia.org/MGASA-2014-0320.htmlThird Party Advisory
http://lambdaops.com/cross-origin-websocket-hijacking-of-ipythonPress/Media Coverage, Technical Description
http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.htmlThird Party Advisory
http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198Broken Link
http://seclists.org/oss-sec/2014/q3/152Third Party Advisory, VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2015:160Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=1119890Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/94497
https://github.com/ipython/ipython/pull/4845Issue Tracking, Patch
http://advisories.mageia.org/MGASA-2014-0320.htmlThird Party Advisory
http://lambdaops.com/cross-origin-websocket-hijacking-of-ipythonPress/Media Coverage, Technical Description
http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.htmlThird Party Advisory
http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198Broken Link
http://seclists.org/oss-sec/2014/q3/152Third Party Advisory, VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2015:160Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=1119890Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/94497
https://github.com/ipython/ipython/pull/4845Issue Tracking, Patch

Timeline

Published: Aug 7, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-34305.0Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows rem CVE-2014-34314.3Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for tempora CVE-2014-34324.3Cross-site scripting (XSS) vulnerability in the management console in Symantec Data Insight 3.x and 4.x before 4.5 allows remote attackers t CVE-2014-34334.3Cross-site scripting (XSS) vulnerability in the management console in Symantec Data Insight 3.x and 4.x before 4.5 allows remote attackers t CVE-2014-34346.9Buffer overflow in the sysplant driver in Symantec Endpoint Protection (SEP) Client 11.x and 12.x before 12.1 RU4 MP1b, and Small Business E CVE-2014-34365.0Symantec Encryption Desktop 10.3.x before 10.3.2 MP3, and Symantec PGP Desktop 10.0.x through 10.2.x, allows remote attackers to cause a den CVE-2014-34377.5The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to read arbitrary files or sen CVE-2014-34384.3Multiple cross-site scripting (XSS) vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before CVE-2014-34396.1ConsoleServlet in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to write to arbitrary files via unspec CVE-2014-34409.0The Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center CVE-2014-34414.3codec\libpng_plugin.dll in VideoLAN VLC Media Player 2.1.3 allows remote attackers to cause a denial of service (crash) via a crafted .png f CVE-2014-34424.3Winamp 5.666 and earlier allows remote attackers to cause a denial of service (memory corruption and crash) via a malformed .FLV file, relat