Cross-Site Request Forgery in JupyterHub

MEDIO 4.5CVE-2020-36191 · BIT-jupyterhub-2020-36191 · GHSA-7xx3-qp5w-fw96 · Published 13/01/2021 · updated 17/06/2026

In breve

CVE-2020-36191 è una vulnerabilità MEDIO (CVSS 4.5) che riguarda jupyterhub, jupyterhub (jupyter).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.51%, superiore al 43.5% delle vulnerabilità.
Correzione: aggiornare a 1.2.0b1 o successiva.

Package	Affected versions	Patched versions
jupyterhub PyPI	`< 1.2.0b1`	`1.2.0b1`
jupyterhub jupyter	`= 1.1.0`	No fix yet

Description

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).

NVD description

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).

References

nvd.nist.gov/vuln/detail/CVE-2020-36191 · ADVISORY
jupyterhub/jupyterhub · WEB
GitHub Advisory GHSA-7xx3-qp5w-fw96 · ADVISORY
jupyterhub/jupyterhub · PACKAGE
jupyterhub/jupyterhub release · WEB
pypa/advisory-database · WEB

Altre vulnerabilità di jupyterhub

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

jupyterhub

PyPI

< 1.2.0b1

1.2.0b1