{"id":"CVE-2020-26232","published":"2020-11-24T21:10:14Z","modified":"2024-08-04T15:56:04Z","title":"Open redirect in Jupyter Server","vendor":"jupyter","product":"jupyter_server","tier":"tail","description":{"text":"Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01004,"percentile":0.62924,"provenance":"source"},"cwes":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site"}],"references":[{"url":"https://github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9v","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157","tags":["x_refsource_MISC"]},{"url":"https://github.com/jupyter-server/jupyter_server/blob/master/CHANGELOG.md#106---2020-11-18","tags":["x_refsource_MISC"]}],"priority":{"score":15.5,"factors":[{"name":"EPSS percentile","points":12.58},{"name":"CVSS severity","points":2.87}]},"vendorSlug":"jupyter","affectedVersions":[{"vendor":"jupyter","product":"jupyter_server","versions":["< 1.0.6"]}],"affected":[{"ecosystem":"PyPI","package":"jupyter-server","vulnerableRanges":["<1.0.6"],"patched":["1.0.6"],"from":["GHSA-grfj-wjv9-4f9v","PYSEC-2020-234"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0090","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-jupyter-server-jupyter-server-cve-2020-26232","children":[{"from":"CVE-2020-26232","to":"CVE-2023-40170","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["jupyter_server/base/handlers.py"],"commits":["https://github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157","https://github.com/jupyter-server/jupyter_server/commit/87a4927272819f0b1cae1afa4c8c86ee2da002fd"],"basis":"rarely changed file"}]},{"from":"CVE-2020-26232","to":"CVE-2023-49080","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["jupyter_server/base/handlers.py"],"commits":["https://github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157","https://github.com/jupyter-server/jupyter_server/commit/0056c3aa52cbb28b263a7a609ae5f17618b36652"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-26232","published":"2020-11-24","fixed":"1.0.6","kev":false},{"cve":"CVE-2020-26275","published":"2020-12-21","fixed":"1.1.1","kev":false,"link":{"from":"CVE-2020-26232","to":"CVE-2020-26275","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:jupyter-server","fromFixed":"1.0.6","toFixed":"1.1.1","daysApart":27},{"kind":"similar","provenance":"machine","score":0.61,"basis":"same package + description similarity"}]}},{"cve":"CVE-2022-24757","published":"2022-03-23","fixed":"1.15.4","kev":false},{"cve":"CVE-2022-29241","published":"2022-06-14","fixed":"2.0.0a1","kev":false}],"package":"PyPI:jupyter-server"}}