GitHub Advisoryadvisory · PyPI

GHSA-rv62-4pmj-xw6h Open Redirect vulnerability in jupyterhub and notebook

MEDIUM Published 2019-04-02 Modified 2023-09-05 Official page ↗
Aliases
CVE-2019-10255
Ecosystem
PyPI
Packages
notebook, jupyterhub
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2020-06-16

Affected packages

• PyPI notebook: < 5.7.8 → fixed in 5.7.8 • PyPI jupyterhub: < 0.9.6 → fixed in 0.9.6

Description

An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.8 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.6 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.

Related

Alias · CVE (1)

  • CVE-2019-10255 An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References