CVE-2018-7206 describes a critical access control bypass vulnerability in Project Jupyter JupyterHub OAuthenticator versions 0.6.x prior to 0.6.2 and 0.7.x prior to 0.7.3. Specifically, when GitLab group whitelisting was enabled for access control, the system failed to correctly verify group membership, allowing unauthorized users to create accounts on the JupyterHub instance. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk. It can be exploited remotely with low attack complexity and low privileges, potentially leading to high impact on confidentiality, integrity, and availability, as unauthorized users could gain access to the platform. Despite its high severity, there is currently no evidence of active exploitation, nor are there any publicly available exploit codes in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting a low level of public awareness or attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.6.0CPE matchmatch criteria | cpe:2.3:a:jupyter:oauthenticator:0.6.0:*:*:*:*:*:*:* | ||
0.6.1CPE matchmatch criteria | cpe:2.3:a:jupyter:oauthenticator:0.6.1:*:*:*:*:*:*:* | ||
0.7.0CPE matchmatch criteria | cpe:2.3:a:jupyter:oauthenticator:0.7.0:*:*:*:*:*:*:* | ||
0.7.1CPE matchmatch criteria | cpe:2.3:a:jupyter:oauthenticator:0.7.1:*:*:*:*:*:*:* | ||
0.7.2CPE matchmatch criteria | cpe:2.3:a:jupyter:oauthenticator:0.7.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.