Threats Tagged 'ghsa-c3mw-737p-c7g2'
View all threats tagged with 'ghsa-c3mw-737p-c7g2'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-c3mw-737p-c7g2'
Click on any threat for detailed analysis and mitigation recommendations
0 ### Summary When a request returns a 500, `jupyter_server/log.py` logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. ### Impact Anyone who can read the server logs can pick tokens out of these 500 entries. Tokens end up in the Referer during normal token-based login and launch flows. Affected: all versions before 2.21.0. ### PoC Any malformed request that returns a 500 works: ```bash curl -i -X POST \ -H 'Content-Type: application/json' \ -H 'Referer: http://127.0.0.1:8899/tree?token=REFERTOKEN' \ --data '{"name":123}' \ 'http://127.0.0.1:8899/api/kernels?token=VALIDTOKEN' ``` The log shows the token twice, once raw and once redacted: ``` "Referer": "http://127.0.0.1:8899/tree?token=REFERTOKEN", [E ... ServerApp] 500 POST /api/kernels?token=[secret] (...) referer=http://127.0.0.1:8899/tree?token=[secret] ``` ### Patches Fixed in 2.21.0 by 5251352. Header values are now scrubbed before the block is logged. Upgrade to 2.21.0 or later. ### Workarounds Limit who can read the server logs. If you can, avoid flows that put the token in the URL. Join the discussion | CVE Database V5 | 09/17/2026, 20:28:55 UTC Added: 09/17/2026, 20:47:37 UTC |
Showing 1 to 1 of 1 result