CVE-2020-36191 - JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account)

Back Back to CVE browser

MEDIUM

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account)

Published Jan 13, 2021

6.7

MEDIUM

CVSS 4.0

EPSS 0.50%

Description

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0106
Advisory
https://github.com/advisories/GHSA-7xx3-qp5w-fw96
Advisory
https://github.com/jupyterhub/jupyterhub/issues/3304
x_refsource_MISCExploitThird Party Advisory
https://github.com/jupyterhub/jupyterhub/releases
x_refsource_MISCThird Party Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2021-67.yaml
https://nvd.nist.gov/vuln/detail/CVE-2020-36191

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0106		Advisory
https://github.com/advisories/GHSA-7xx3-qp5w-fw96		Advisory
https://github.com/jupyterhub/jupyterhub/issues/3304		x_refsource_MISCExploitThird Party Advisory
https://github.com/jupyterhub/jupyterhub/releases		x_refsource_MISCThird Party Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2021-67.yaml
https://nvd.nist.gov/vuln/detail/CVE-2020-36191