CVE-2020-36191: CSRF
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).
Other sources
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).
— GitHub
Project Jupyter JupyterHub is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input by the admin panel. By persuading an authenticated user to visit a malicious Web site, a remote authenticated attacker could send a malformed HTTP request to add or remove a user account. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-36191?
CVE-2020-36191 is a vulnerability in JupyterHub 1.1.0 that allows CSRF in the admin panel via a request that lacks an `_xsrf` field.
What is the severity of CVE-2020-36191?
The severity of CVE-2020-36191 is medium with a severity score of 4.5.
How does CVE-2020-36191 affect JupyterHub?
CVE-2020-36191 affects JupyterHub 1.1.0 by allowing CSRF in the admin panel through a request that lacks an `_xsrf` field.
How can I fix CVE-2020-36191?
To fix CVE-2020-36191, upgrade JupyterHub to version 1.2.0b1 or higher.
Where can I find more information about CVE-2020-36191?
You can find more information about CVE-2020-36191 on the NVD website (https://nvd.nist.gov/vuln/detail/CVE-2020-36191) and the JupyterHub GitHub page (https://github.com/jupyterhub/jupyterhub/issues/3304).