AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

JupyterGHSA-7xx3-qp5w-fw96

Cross-Site Request Forgery in JupyterHub

Jupyter

CVE-2020-36191 · Published May 24, 2022 · updated Sep 24, 2024

Medium4.5
Fix: upgrade to 1.2.0b1 or later
GitHub advisory

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).

Affected versions

PackageAffectedFixed in
jupyterhub
PyPI
< 1.2.0b11.2.0b1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-352
Also known as
BIT-jupyterhub-2020-36191, CVE-2020-36191, PYSEC-2021-67

More Jupyter advisories

All Jupyter
High 7.1Jun 16, 2022Jupyter server Token bruteforcingCVE-2022-29241fixed in 1.17.1 +1Medium 4.3Jun 16, 2022Token bruteforcingCVE-2022-29238fixed in 6.4.12Critical 9.8May 17, 2022Improper Input Validation in Jupyter NotebookCVE-2015-7337fixed in 4.0.5 +1Medium 6.1May 14, 2022Improper Neutralization of Input During Web Page Generation in Jupyter NotebookCVE-2015-6938fixed in 4.0.5 +1Medium 5.4May 14, 2022Improper Neutralization of Input During Web Page Generation in Jupyter NotebookCVE-2019-9644fixed in 5.7.6High 7.5Apr 5, 2022Sensitive Auth & Cookie data stored in Jupyter server logsCVE-2022-24758fixed in 6.4.10