High severity · published Feb 18, 2018
CVE-2018-7206
An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3
8.8
CVSS
1.8%
EPSS
No
On KEV
Description
An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. (Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlab_group_whitelist is unaffected. No other Authenticators are affected.)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
Oauthenticator · Jupyter
0.6.0; 0.6.1; 0.7.0; 0.7.1; 0.7.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7206
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7206
Third Party Advisory
https://blog.jupyter.org/security-fix-for-jupyterhub-gitlab-oauthenticator-7b14571d1f76
Release Notes
https://github.com/jupyterhub/oauthenticator/blob/8499dc2/CHANGELOG.md#073---2018-02-16
Patch
https://github.com/jupyterhub/oauthenticator/commit/1845c0e4b1bff3462c91c3108c85205acd3c75a2
More from Oauthenticator
9.1
CVE-2024-29033
OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider
8.8
CVE-2026-33175
OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims
6.5
CVE-2022-31027
OAuthenticator is an OAuth token library for the JupyerHub login handler
6.3
CVE-2020-26250
OAuthenticator is an OAuth login mechanism for JupyterHub