Lucene search

[email protected]CVE-2020-26275

HistoryDec 21, 2020 - 6:15 p.m.

CVE-2020-26275

2020-12-2118:15:15

CWE-601

[email protected]

web.nvd.nist.gov

cve-2020-26275

jupyter server

open redirect vulnerability

api

rest endpoints

security patch

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.2%

JSON

The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious website. All jupyter servers running without a base_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8. This is fixed in jupyter_server 1.1.1. If upgrade is not available, a workaround can be to run your server on a url prefix: “jupyter server --ServerApp.base_url=/jupyter/”.

Affected configurations

Vulners

NVD

Node

jupyter-serverjupyter_serverRange<1.1.1

CPENameOperatorVersion
jupyter:jupyter_serverjupyter jupyter serverlt1.1.1

CPE	Name	Operator	Version
jupyter:jupyter_server	jupyter jupyter server	lt	1.1.1

CNA Affected

[
  {
    "product": "jupyter_server",
    "vendor": "jupyter-server",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.1.1"
      }
    ]
  }
]