{"id":"CVE-2015-4706","published":"2017-09-21T14:00:00Z","modified":"2024-08-06T06:25:20Z","title":"Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web…","vendor":null,"product":null,"tier":"tail","description":{"text":"Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.021,"percentile":0.81658,"provenance":"source"},"cwes":[],"references":[{"url":"https://ipython.org/ipython-doc/3/whatsnew/version3.html","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfce","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2015/06/22/7","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549c","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/75328","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1235688","tags":["x_refsource_CONFIRM"]}],"priority":{"score":16.3,"factors":[{"name":"EPSS percentile","points":16.33}]},"affected":[{"ecosystem":"PyPI","package":"ipython","vulnerableRanges":[">=3.0.0, <3.2.0"],"patched":["3.2.0"],"from":["GHSA-q326-jhw3-699g","PYSEC-2017-45"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-0062","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ipython-cve-2015-7337","parents":[{"from":"CVE-2015-7337","to":"CVE-2015-4706","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["IPython/html/services/contents/handlers.py"],"commits":["https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfce","https://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549c","https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967"],"basis":"shared function","functions":["validate_model"]}]}],"children":[{"from":"CVE-2015-4706","to":"CVE-2015-5607","relation":"successor","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ipython","fromFixed":"3.2.0","toFixed":"3.2.1","daysApart":-1},{"kind":"same-code","provenance":"machine","files":["IPython/html/base/handlers.py"],"commits":["https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfce","https://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549c","https://github.com/ipython/ipython/commit/1415a9710407e7c14900531813c15ba6165f0816","https://github.com/ipython/ipython/commit/a05fe052a18810e92d9be8c1185952c13fe4e5b0"],"basis":"shared function","functions":["write_error"]}]}],"packageHistory":[{"cve":"CVE-2014-3429","published":"2014-08-07","fixed":"1.2.0","kev":false},{"cve":"CVE-2015-4706","published":"2017-09-21","fixed":"3.2.0","kev":false},{"cve":"CVE-2015-4707","published":"2017-09-20","fixed":"3.2.0","kev":false},{"cve":"CVE-2015-6938","published":"2015-09-21","fixed":"3.2.2","kev":false},{"cve":"CVE-2015-7337","published":"2015-09-29","fixed":"3.2.2","kev":false}],"package":"PyPI:ipython"}}