JupyterGHSA-7xx3-qp5w-fw96
Cross-Site Request Forgery in JupyterHub
Medium4.5CVE-2020-36191 · Published May 24, 2022 · updated Sep 24, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| jupyterhub PyPI | < 1.2.0b1 | 1.2.0b1 |
Details and references
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an `_xsrf` field, as demonstrated by a /hub/api/user request (to add or remove a user account).
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-352
- Also known as
- BIT-jupyterhub-2020-36191, CVE-2020-36191, PYSEC-2021-67
More Jupyter advisories
All Jupyter| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 172022 | Improper Input Validation in Jupyter Notebook CVE-2015-7337Critical9.8fixed in 4.0.5 | Critical9.8 | 4.0.5 |
| May 142022 | Improper Neutralization of Input During Web Page Generation in Jupyter Notebook CVE-2015-6938Medium6.1fixed in 4.0.5 | Medium6.1 | 4.0.5 |
| May 142022 | Improper Neutralization of Input During Web Page Generation in Jupyter Notebook CVE-2019-9644Medium5.4fixed in 5.7.6 | Medium5.4 | 5.7.6 |
| Jun 162022 | Token bruteforcing. CVE-2022-29238Medium4.3fixed in 6.4.12 | Medium4.3 | 6.4.12 |
| Jun 162022 | Jupyter server Token bruteforcing CVE-2022-29241High7.1fixed in 1.17.1, 2.0.0a1 | High7.1 | 1.17.1, 2.0.0a1 |
| Apr 52022 | Sensitive Auth & Cookie data stored in Jupyter server logs CVE-2022-24758High7.5fixed in 6.4.10 | High7.5 | 6.4.10 |