CVE-2020-36191

Published January 13th, 2021

View on NVD ↗

CVSS v3

4.5

MEDIUM

CVSS v2

3.5

LOW

Affected

PROJECT

Description

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).

jupyterhub/jupyterhub

Multi-user server for Jupyter notebooks

GitHub

8.31K