CVE-2023-37916

CVE-2023-37916: KubePi (github.com/KubeOperator/kubepi) had a leak in /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 that exposed password hashes for any user (including admin). The root cause is a leaking endpoint returning password hashes; no workaround is documented. The issue has been fix...

CVE-2023-22463

KubePi (Kubernetes dashboard) vulnerability CVE-2023-22463: The jwt authentication in versions up to 1.6.2 used hard-coded JwtSigKey in session.go, enabling forging of JWTs and unauthorized admin access across projects; attacker could escalate to K8s cluster control. The issue is fixed in 1.6.3, ...

CVE-2023-22478

CVE-2023-22478 affects KubePi up to version 1.6.4, enabling unauthorized API access that can expose sensitive information. The issue is publicly documented across multiple sources (NVD, NVD-derived feeds, and project advisories) and has a confirmed patch in version 1.6.4. All connected sources de...

CVE-2023-22479

CVE-2023-22479 affects KubePi (Kubernetes panel). Vulnerable in versions 1.6.3 and earlier due to a session fixation vulnerability that can allow an attacker to hijack a legitimate user session. Root cause involves how session IDs are handled. The advisory notes a patch is available in version 1....

CVE-2023-37917

KubePi Privilege Escalation vulnerability: a normal user can elevate privileges by editing the isadmin field in requests, gaining admin control. Root cause is improper authorization in user-create/update flow. Impact is administrative access with high confidentiality/integrity/availability concer...