CVE-2019-10255
Medium
Description
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
SeverityMedium
CVSS6.1
Exploit probability—
ProductJupyterhub
PublishedMar 28, 2019
First seenMar 28, 2019
How to fix
Update
- jupyter jupyterhub0.9.5 or later
- jupyter notebook5.7.7 or later
- notebook5.7.8 or later
- jupyterhub0.9.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jupyter jupyterhub | v < 0.9.5 | 0.9.5 |
| jupyter notebook | v < 5.7.7 | 5.7.7 |
| notebookPyPI | v < 5.7.8 | 5.7.8 |
| jupyterhubPyPI | v < 0.9.6 | 0.9.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.