CVE-2023-22478 KubePi is vulnerable to missing authorization

2023-01-1400:22:54

CWE-862

GitHub_M

www.cve.org

kubepi

vulnerability

patched

version

1.6.4

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

0.137 Low

EPSS

Percentile

95.7%

JSON

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.

CNA Affected

[
  {
    "vendor": "KubeOperator",
    "product": "KubePi",
    "versions": [
      {
        "version": "<= 1.6.3 ",
        "status": "affected"
      }
    ]
  }
]