Every CVE Search/ Get API key

CVE-2015-4707

Improper Neutralization of Input During Web Page Generation in IPython

6.1 MediumFix available

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

2.27%Up 1.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.1

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

Record
CVE-2015-4707
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

Record
CVE-2015-4707
Updated
2026-11-02
EUVDEUVD-2017-0063 No score

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

Record
EUVD-2017-0063
Updated
2026-11-03
GitHub AdvisoriesGHSA-66gw-5xpf-gfp5 5.3

Improper Neutralization of Input During Web Page Generation in IPython

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

Record
GHSA-66gw-5xpf-gfp5
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.1

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

Record
CVE-2015-4707
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2015-4707 6.1

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

Record
DEBIAN-CVE-2015-4707
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-66gw-5xpf-gfp5 5.3

Improper Neutralization of Input During Web Page Generation in IPython

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

Record
GHSA-66gw-5xpf-gfp5
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2015-4707 6.1

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

Record
UBUNTU-CVE-2015-4707
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVMGASA-2015-0300 No score

Updated ipython package fixes security vulnerability

JSON error responses from the IPython notebook REST API contained URL parameters and were incorrectly reported as text/html instead of application/json. The error messages included some of these URL params, resulting in a cross site scripting attack (CVE-2015-4707).

POST requests exposed via the IPython REST API are vulnerable to cross-site request forgery (CSRF). Web pages on different domains can make non-AJAX POST requests to known IPython URLs, and IPython will honor them. The user's browser will automatically send IPython cookies along with the requests. The response is blocked by the Same-Origin Policy, but the request isn't (CVE-2015-5607).

The Mageia 5 package has been patched to fix these issues. The Mageia 4 package wasn't vulnerable to CVE-2015-4707, but it has been updated and patched to fix CVE-2015-5607.

Record
MGASA-2015-0300
Updated
2026-11-02
OSVPYSEC-2017-46 No score

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

Record
PYSEC-2017-46
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ipython
PyPI
 before 3.2.0
3.2.0
ipython
Debian:12
 before 2.4.1-1
2.4.1-1
ipython
Debian:13
 before 2.4.1-1
2.4.1-1
ipython
Debian:14
 before 2.4.1-1
2.4.1-1
ipython
PyPI
 before 3.2.0, plus listed versions
0.100.10.10.10.20.110.12
Show 42 moreShow less
0.12.10.130.13.10.13.20.6.100.6.110.6.120.6.130.6.140.6.150.6.40.6.50.6.60.6.70.6.80.6.90.7.00.7.10.7.1.fix10.7.20.7.30.7.4.svn.r20100.8.00.8.10.8.20.8.30.8.40.90.9.11.0.01.1.01.2.01.2.12.0.02.1.02.2.02.3.02.3.12.4.02.4.13.0.03.1.0
3.2.0
ipython
Mageia:4
 before 2.3.0-1.mga4
2.3.0-1.mga4
ipython
Mageia:5
 before 2.3.0-2.2.mga5
2.3.0-2.2.mga5

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-4707 is a medium vulnerability (CVSS 6.1) in Ipython, published August 3, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.27%, the 83rd percentile. Fixed in ipython 3.2.0.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open