CVE-2023-37916

Summary

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected Software

Weaknesses

• CWE-200: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-87f6-8gr7-pc6h

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-87f6-8gr7-pc6h

• ←Previous
• Next→