6.1

CVE-2020-26215: Open redirect in Jupyter Notebook

Modified
AliasesMGASA-2020-0457openSUSE-SU-2021:0117-1GHSA-c7vm-f5p4-8fqh
Published 18-11-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-26215 is a medium (CVSS 6.1) URL Redirection to Untrusted Site vulnerability in debian debian_linux. EPSS estimates a 1.23% chance of exploitation in the next 30 days, higher than 68.9% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 4.4, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.1/10
010
Medium · v3.1 (NVD)
EPSS score
1.23%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
MGASA-2022-0323USN-5585-1

Timeline

  1. 18-11-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may appear safe, but ultimately redirect to a spoofed server on the public internet. The issue is patched in version 6.1.5.

CVSS metrics

7 scores · 5 sources · 3 versions

EPSS trend

Probability

1.23%

Chance of exploitation in the next 30 days

Percentile

69%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.23% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.

Debian2 products
  • jupyter-notebook< 4.2.3-4+deb9u2 | < 6.1.5-1
  • debian_linuxEOL9.0
Opensuse2 products
  • python-jupyter_notebook&distro=openSUSE Leap 15.1< 5.7.7-lp151.2.3.1
  • python-notebook&distro=openSUSE Leap 15.2< 5.7.8-lp152.2.3.1
Jupyter1 product
Mageia1 product
  • jupyter-notebook< 5.7.8-1.1.mga7
PyPI1 product
  • notebook< 3cec4bbe21756de9f0c4bccf18cf61d840314d74 | < 6.1.5
Suse1 product
  • python-jupyter_notebook&distro=SUSE Package Hub 15 SP1< 5.7.7-bp151.3.3.1
Ubuntu1 product
  • jupyter-notebook< 5.2.2-1ubuntu0.1 | < 6.0.3-2ubuntu0.1

7 vendors · 9 products

References

19 links
Show all 19 references