CVE-2024-29033
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2024-29033: In earlier versions of OAuthenticator for JupyterHub, the GoogleOAuthenticator plugin had a flawed restriction mechanism for authorizing Google accounts. The intended restriction was to Google accounts associated with verified organizations controlling specific domains. However, prior to version 16.3.0, the actual restriction was based on email domain suffixes, allowing unauthorized access for accounts that had once been associated with the domain. This issue, disclosed by Dylan Ayrey, was addressed in version 16.3.0. As a temporary solution, administrators can restrict logins using alternative methods, such as `allowed_users` or `allowed_google_groups`.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions