Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2024-28233 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Jupyter Jupyterhub. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0861
Vulnerability Data
JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could…
more
achieve full access to JupyterHub API and user's single-user server. The affected configurations are single-origin JupyterHub deployments and JupyterHub deployments with user-controlled applications running on subdomains or peer subdomains of either the Hub or a single-user server. This vulnerability is fixed in 4.1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.3.2V3.5.1V10.2.1V1.1.2
Mitigating Controls (NIST 800-53 r5) AI
Access Enforcement requires authorizations to be enforced by the system rather than by trusting client-supplied cookie values.
Developer testing and evaluation can discover missing or incorrect input neutralization through targeted web-application tests.
Session Authenticity directly requires protecting the integrity and authenticity of session tokens such as cookies, eliminating blind reliance on them.
Input validation directly enforces neutralization of untrusted data before it reaches web output generation.
Output filtering can catch or sanitize unneutralized script content before it is served to users.
Transmission Confidentiality and Integrity mandates cryptographic or equivalent protection for data in transit, which covers cookie values exchanged over HTTP.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Cookies commonly carry identity assertions; requiring their protection, conveyance, and verification directly eliminates the weakness.
Strong authentication mechanisms reduce reliance on unvalidated cookies for identity and access decisions.
Cryptographic integrity for data-in-transit directly mitigates tampering of cookies sent over the network.
Secure SDLC practices directly target introduction of XSS via coding standards/testing (mostly), yet the single broad outcome leaves many specific neutralization vectors unaddressed (partial).
Enforcing access policy and least privilege limits damage from cookie misuse but does not address cookie validation itself.
Integrity protections for data-at-rest can apply to cookie stores but do not cover validation during use.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure-coding testing and automated code-analysis tools are applied to detect improper neutralization of script-related content during web-page generation.
Knowledge exchange on emerging attack techniques and patches reduces the likelihood that cross-site scripting flaws remain unaddressed in deployed applications.
Operational indicators of compromise for web-application attacks can be incorporated into WAF or input-filtering rules, lowering the likelihood that unsanitized data reaches the browser.
By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.
Requiring language-specific secure-coding standards and automated scanning during the SDLC catches missing output encoding or improper neutralization of untrusted data before the software reaches production.
Application security requirements can mandate cookie validation, integrity protection, and server-side session handling.