--- title: "CX-2020-4291" date: "2020-12-17T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2020-4291/" --- # CX-2020-4291 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Dec 17, 2020 CVE-2020-26275 **Published:** Dec 17, 2020 CWE-601 CWE-601 URL Redirection to Untrusted Site ('Open Redirect') 6.1 Medium Severity open redirect python YN Yaniv Nizry Reported by Checkmarx Zero Details Overview ## Summary The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Affected versions of Jupyter Server are vulnerable to open redirect vulnerability. All jupyter servers running without a base\_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. ## Product Jupyter Server before version 1.1.1 ## Impact A link to a jupyter server may appear safe, but ultimately redirect to a malicious site. ## Steps to reproduce 1. Run a jupyter server on port 1111 2. Navigate to `http://localhost:1111/login?next=//example.com` ### Expected result: `https://example.com` will load. ## Remediation Use on of the two options: 1. Update jupyter\_server package to 1.1.1 or above. 2. Run your server on a url prefix: “jupyter server –ServerApp.base\_url=/jupyter/”. ## Credit This issue was discovered and reported by Checkmarx SCA Security Researcher [Yaniv Nizry](https://twitter.com/ynizry). ## Resources 1. [Advisory](https://github.com/advisories/GHSA-9f66-54xg-pc2c) 2. [85e4abc](https://github.com/jupyter-server/jupyter_server/commit/85e4abccf6ea9321d29153f73b0bd72ccb3a6bca) 0 Medium Severity CVSS v3.1 Score 6.1 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None Advisory Timeline1. Discovered Dec 9, 2020 Notified the maintainer 2. Fixed Dec 17, 2020 Fix commit got released ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)