An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
CVE-2019-10255 - Medium Severity Vulnerability
A web-based notebook environment for interactive computing
path: /tender_samet/requirements.txt
Library home page: https://pypi.python.org/packages/20/13/746be25c0cd02edd65491909cd3bb7c81d5f4ae31107798397962085ec34/notebook-5.0.0-py2.py3-none-any.whl
Dependency Hierarchy: - :x: **notebook-5.0.0-py2.py3-none-any.whl** (Vulnerable Library)An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
Publish Date: 2019-03-28
URL: CVE-2019-10255
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb
Release Date: 2019-03-28
Fix Resolution: 5.7.7
Step up your Open Source Security Game with WhiteSource here