Veracode Vulnerability DatabaseVERACODE:48426Privilege Escalation
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
28.5%
JupyterHub is vulnerable to Privilege Escalation. The vulnerability is due to improper management of the admin:users scope in users.py, which unintentionally allows users to elevate their privileges to full admin status.
References
github.com/advisories/GHSA-9x4q-3gxw-849f
github.com/jupyterhub/jupyterhub/commit/99e2720b0fc626cbeeca3c6337f917fdacfaa428
github.com/jupyterhub/jupyterhub/commit/ff2db557a85b6980f90c3158634bf924063ab8ba
github.com/jupyterhub/jupyterhub/security/advisories/GHSA-9x4q-3gxw-849f
jupyterhub.readthedocs.io/en/stable/rbac/scopes.html#available-scopes
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
28.5%