KubePi may allow unauthorized access to system API

Description

References

• 1Panel-dev/KubePi security advisory · WEB
• KubeOperator/KubePi security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2023-22478 · ADVISORY
• KubeOperator/KubePi commit 0c6774b · WEB
• KubeOperator/KubePi · PACKAGE
• KubeOperator/KubePi release v1.6.4 · WEB

Más vulnerabilidades de github.com/KubeOperator/kubepi

• CVE-2023-37917ALTO 8.8KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing t…
• CVE-2023-37916ALTO 7.5KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of a…
• CVE-2023-22479MEDIO 6.5KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and be…
• CVE-2023-22463CRÍTICO 9.8KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwt…