CVE-2024-35178

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access to the Windows machine hosting the Jupyter server, or access other network-accessible machines or 3rd party services using that credential. Or an attacker perform an NTLM relay attack without cracking the credential to gain access to other network-accessible machines. This vulnerability is fixed in 2.14.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jun 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-351796.8Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using `RUN_AS_USER`, the specified user (and therefore, web CVE-2024-35186.5The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and inc CVE-2024-351806.1OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter th CVE-2024-351818.1Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. CVE-2024-351828.1Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. CVE-2024-351834.4wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub CVE-2024-351845.5Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 CVE-2024-351855.3Minder is a software supply chain security platform. Prior to version 0.0.49, the Minder REST ingester is vulnerable to a denial of service CVE-2024-351868.8gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the wo CVE-2024-351879.1Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-CVE-2024-351896.5Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` CVE-2024-35196.1The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up t