GHSA-7xx3-qp5w-fw96

Cross-Site Request Forgery in JupyterHub

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-36191

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	jupyterhub	< 1.2.0b1	1.2.0b1

Details

As written in the advisory (Markdown source, shown as plain text).

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an `_xsrf` field, as demonstrated by a /hub/api/user request (to add or remove a user account).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-36191 advisory
https://github.com/jupyterhub/jupyterhub/issues/3304 web
https://github.com/advisories/GHSA-7xx3-qp5w-fw96 advisory
https://github.com/jupyterhub/jupyterhub package
https://github.com/jupyterhub/jupyterhub/releases web
https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2021-67.yaml web