Threats tagged 'ghsa-c3mw-737p-c7g2'

Jupyter Server versions prior to 2.21.0 contain a vulnerability where the Referer header is logged without scrubbing sensitive tokens during 5xx error responses. This can lead to sensitive tokens being stored in plaintext in server logs. An attacker with access to these logs could recover tokens and gain the affected user's permissions. The issue is fixed in version 2.21.0.