KubePi may leak password hash of any user

ALTO 7.5CVE-2023-37916 · GHSA-87f6-8gr7-pc6h · GO-2023-1957 · Published 21/07/2023 · updated 17/06/2026

En resumen

CVE-2023-37916 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a github.com/KubeOperator/kubepi, kubepi (fit2cloud).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.81%, mayor que el 57.1% de las vulnerabilidades.
Solución: actualizar a 1.6.5 o posterior.

Package	Affected versions	Patched versions
github.com/KubeOperator/kubepi Go	`< 1.6.5`	`1.6.5`
kubepi fit2cloud	`< 1.6.5`	`1.6.5`

Description

Summary

http://kube.pi/kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password of any user (including admin). This leads to password crack attack

PoC

https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview

Impact

Leaking confidential information.
Can lead to password cracking attacks

NVD description

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

1Panel-dev/KubePi security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-37916 · ADVISORY
drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview · WEB
1Panel-dev/KubePi · PACKAGE
1Panel-dev/KubePi release v1.6.5 · WEB

Más vulnerabilidades de github.com/KubeOperator/kubepi

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/KubeOperator/kubepi

< 1.6.5

1.6.5

kubepi

fit2cloud

< 1.6.5

1.6.5

Description

NVD description

Más vulnerabilidades de github.com/KubeOperator/kubepi

Ver todo →