GitHub Advisoryadvisory · PyPI
GHSA-7xx3-qp5w-fw96 Cross-Site Request Forgery in JupyterHub
MEDIUM
Official page ↗
- Aliases
- CVE-2020-36191
- Ecosystem
- PyPI
- Packages
- jupyterhub
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-352
- Reviewed
- 2022-06-23
Affected packages
• PyPI jupyterhub: < 1.2.0b1 → fixed in 1.2.0b1
Description
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an `_xsrf` field, as demonstrated by a /hub/api/user request (to add or remove a user account).
Related
Alias · CVE (1)
- CVE-2020-36191 JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add… vulnerability
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-36191 advisory
- https://github.com/jupyterhub/jupyterhub/issues/3304 web
- https://github.com/advisories/GHSA-7xx3-qp5w-fw96 advisory
- https://github.com/jupyterhub/jupyterhub package
- https://github.com/jupyterhub/jupyterhub/releases web
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2021-67.yaml web