Medium severity · published Mar 28, 2019
CVE-2019-10255
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login…
6.1
CVSS
1.8%
EPSS
No
On KEV
Description
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JU
Jupyterhub · Jupyter
before 0.9.5 · source: NVD
NO
Notebook · Jupyter
before 5.7.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10255
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10255
Vendor Advisory
https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4
Patch
https://github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb
Patch
https://github.com/jupyter/notebook/commit/70fe9f0ddb3023162ece21fbb77d5564306b913b
Patch
https://github.com/jupyter/notebook/commit/d65328d4841892b412aef9015165db1eb029a8ed
Patch
https://github.com/jupyter/notebook/compare/05aa4b2...16cf97c
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D/
More from Jupyterhub
7.5
CVE-2021-41247
JupyterHub is an open source multi-user server for Jupyter notebooks
7.2
CVE-2024-41942
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks
6.1
CVE-2026-33709
JupyterHub has an Open Redirect Vulnerability
6.1
CVE-2024-28233
JupyterHub is an open source multi-user server for Jupyter notebooks
4.5
CVE-2020-36191
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account)