CVE-2023-22479

KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4...

VulnCheck KEV: CVE-2024-36111

KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the...

GO-2023-1956 KubePi Privilege Escalation vulnerability in github.com/KubeOperator/kubepi

KubePi Privilege Escalation vulnerability in github.com/KubeOperator/kubepi...

GO-2023-1957 KubePi may leak password hash of any user in github.com/KubeOperator/kubepi

KubePi may leak password hash of any user in github.com/KubeOperator/kubepi...

GO-2023-1283 KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys in github.com/KubeOperator/kubepi

KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys in github.com/KubeOperator/kubepi...

GO-2023-1468 KubePi session fixation attack allows an attacker to hijack a legitimate user session. in github.com/KubeOperator/kubepi

KubePi session fixation attack allows an attacker to hijack a legitimate user session. in github.com/KubeOperator/kubepi...

GO-2023-1463 KubePi may allow unauthorized access to system API in github.com/KubeOperator/kubepi

KubePi may allow unauthorized access to system API in github.com/KubeOperator/kubepi...

CVE-2024-36111

KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the ke...

CVE-2024-36111 KubePi's JWT token validation has a defect

KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the ke...

CVE-2024-36111

The CVE-2024-36111 issue affects KubePi (K8s panel). Root cause: an empty JWT key in the default configuration leads to token verification failures, allowing a forged JWT to bypass login and take over the backend. Affected versions: 1.6.3 through 1.7.x (prior to 1.8.0). Version 1.8.0 contains a p...

CVE-2024-36111 KubePi's JWT token validation has a defect

KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the ke...

CVE-2024-36111 KubePi's JWT token validation has a defect

KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the ke...

1Panel KubePi 安全漏洞

1Panel KubePi is a K8s panel from the Chinese company 1Panel. It allows administrators to import multiple Kubernetes clusters and assign permissions for different clusters, namespaces to specified users through permission control. A security vulnerability exists in 1Panel KubePi version 1.6.3 up ...

VulnCheck KEV: CVE-2023-22478

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds...

Privilege Escalation

github.com/kubeoperator/kubepi is vulnerable toPrivilege Escalation . The vulnerability exists due to improper permission restrictions when creating or updating users which allows an attacker to perform authorized actions on users such as changing roles...

Information Disclosure

github.com/kubeoperator/kubepi is vulnerable to Information Disclosure. The vulnerability exists because the password hash is not properly restricted to authenticated users which allows an attacker to gain access to sensitive information such as a password hash...

CVE-2023-37916

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user including admin. A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users...

CVE-2023-37917

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are...

Design/Logic Flaw

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user including admin. A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users...

KubePi may leak password hash of any user

Summary http://kube.pi/kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password of any user including admin. This leads to password crack attack PoC https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview Impact - Leaking confidential information. - Can lead to password...