Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2024-28188

jupyter-scheduler's endpoint is missing authentication

Description

Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyter-scheduler` users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jupyter-server jupyter-scheduler

  • >= 1.0.0, <= 1.1.5affected
  • = 1.2.0affected
  • >= 1.3.0, <= 1.8.1affected
  • >= 2.0.0, <= 2.5.1affected

References