medium4.5
CVE-2020-36191
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user ac…
Impact
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jupyter | Jupyterhub | Version 1.1.0 |