CVE-2020-36191: Cross-Site Request Forgery in JupyterHub

May 24, 2022 (updated September 24, 2024)

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).

References

github.com/advisories/GHSA-7xx3-qp5w-fw96
github.com/jupyterhub/jupyterhub
github.com/jupyterhub/jupyterhub/issues/3304
github.com/jupyterhub/jupyterhub/releases
github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2021-67.yaml
nvd.nist.gov/vuln/detail/CVE-2020-36191

Code Behaviors & Features

Detect and mitigate CVE-2020-36191 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →