CVE-2019-10255: Medium severity ibm cognos analytics vulnerability
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a baseurl prefix are not affected.
Other sources
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.8 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.6 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a baseurl prefix are not affected.
Jupyter Notebook and JupyterHub could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit this vulnerability using a specially-crafted URL to redirect a victim to arbitrary Web sites.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-10255?
CVE-2019-10255 is an Open Redirect vulnerability in Jupyter Notebook and JupyterHub.
Which browsers are affected by CVE-2019-10255?
All browsers in Jupyter Notebook before version 5.7.8 and some browsers (Chrome, Firefox) in JupyterHub before version 0.9.6 are affected.
How can CVE-2019-10255 be exploited?
Crafted links can be used to redirect users to a malicious site after successful login in Jupyter Notebook and JupyterHub.
Are servers running on a base_url prefix affected by CVE-2019-10255?
No, servers running on a base_url prefix are not affected by CVE-2019-10255.
What is the severity of CVE-2019-10255?
CVE-2019-10255 has a severity score of 6.1 (Medium).