CVE-2020-36191 Cross-Site Request Forgery in JupyterHub
Attackers can perform unauthorized admin actions like adding or removing users in JupyterHub due to missing CSRF protection.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-36191?
CVE-2020-36191 is a medium-severity vulnerability in n/a, published on 13 Jan 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).
Weakness: CWE-352
Which versions are affected by CVE-2020-36191?
4 open source packages ship an affected version, including jupyterhub. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jupyterhub Bitnami | From 1.1.0 | 1.1.1 |
jupyterhub PyPI | All versions | 1.2.0b1 |
jupyterhub PyPI | All versions | 1.2.0b1 |
jupyterhub PyPI | All versions | 1.2.0b1 |
Products include Jupyter Jupyterhub.
How do I fix CVE-2020-36191?
Upgrade jupyterhub to a fixed version for your release line: 1.1.1 or 1.2.0b1.
Is CVE-2020-36191 being exploited?
There is no known exploitation of CVE-2020-36191 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-28233 XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing
- CVE-2024-41942 JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
- CVE-2019-10255 Open Redirect vulnerability in jupyterhub and notebook
- CVE-2026-40864 JupyterHub: Cross-origin form POSTs bypass XSRF
- CVE-2026-33709 JupyterHub has an Open Redirect Vulnerability
Sources
Also known as BIT-jupyterhub-2020-36191, DEBIAN-CVE-2020-36191, GHSA-7xx3-qp5w-fw96, PYSEC-2021-67, UBUNTU-CVE-2020-36191.