CVE-2020-36191

Description

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).

Risk Information

Base Score

4.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

EPSS Score

Exploitation Probability

0.124

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.2.4	Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 12.0.3	Windows
Vulnerabilities CVE-2020-36191 are fixed in Python-jupyterhub 1.2.0b1	Windows
Vulnerabilities CVE-2020-36191 are fixed in Python-jupyterhub for linux 1.2.0b1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234