CVE-2025-61669

Katalog CVE

CVSS 6.1 · Medium EPSS 0,24%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada jupyter server. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.

Rincian

Terbit di NVD

5 Mei 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w exploit · advisory vendor