Skip to content
JupyterGHSA-7xx3-qp5w-fw96

Cross-Site Request Forgery in JupyterHub

Medium4.5CVE-2020-36191 · Published May 24, 2022 · updated Sep 24, 2024

GitHub advisory

Affected versions

PackageAffectedFixed in
jupyterhub
PyPI
< 1.2.0b11.2.0b1
Details and references

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an `_xsrf` field, as demonstrated by a /hub/api/user request (to add or remove a user account).

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-352
Also known as
BIT-jupyterhub-2020-36191, CVE-2020-36191, PYSEC-2021-67

More Jupyter advisories

All Jupyter
DateAdvisory
May 172022Improper Input Validation in Jupyter Notebook
CVE-2015-7337Critical9.8fixed in 4.0.5
May 142022Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
CVE-2015-6938Medium6.1fixed in 4.0.5
May 142022Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
CVE-2019-9644Medium5.4fixed in 5.7.6
Jun 162022Token bruteforcing.
CVE-2022-29238Medium4.3fixed in 6.4.12
Jun 162022Jupyter server Token bruteforcing
CVE-2022-29241High7.1fixed in 1.17.1, 2.0.0a1
Apr 52022Sensitive Auth & Cookie data stored in Jupyter server logs
CVE-2022-24758High7.5fixed in 6.4.10

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.