CVE-2023-39968
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The vulnerability in jupyter-server allows for an Open Redirect attack, enabling redirection of users to arbitrary sites after logging into a Jupyter server. Maliciously crafted login links can lead to unauthorized redirects.
Risk Assessment
Organizations may be exposed to phishing and other attacks that exploit user trust in the Jupyter server. This could lead to data exposure or session hijacking.
Recommendation
It is recommended to upgrade to version 2.7.2 or later to mitigate this vulnerability. There are no known workarounds for this issue.
Original NVD description (English source)
jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit `29036259` which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.