Go modules package
github.com/kubeoperator/kubepi
pkg:golang/github.com/kubeoperator/kubepi
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-37916 | — | < 1.6.5 | 1.6.5 | Jul 21, 2023 | KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in v | ||
| CVE-2023-37917 | — | < 1.6.5 | 1.6.5 | Jul 21, 2023 | KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version | ||
| CVE-2023-22478 | — | < 1.6.4 | 1.6.4 | Jan 14, 2023 | KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds. | ||
| CVE-2023-22479 | — | < 1.6.4 | 1.6.4 | Jan 10, 2023 | KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4. | ||
| CVE-2023-22463 | — | < 1.6.3 | 1.6.3 | Jan 4, 2023 | KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online pr |
- CVE-2023-37916Jul 21, 2023affected < 1.6.5fixed 1.6.5
KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in v
- CVE-2023-37917Jul 21, 2023affected < 1.6.5fixed 1.6.5
KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version
- CVE-2023-22478Jan 14, 2023affected < 1.6.4fixed 1.6.4
KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
- CVE-2023-22479Jan 10, 2023affected < 1.6.4fixed 1.6.4
KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.
- CVE-2023-22463Jan 4, 2023affected < 1.6.3fixed 1.6.3
KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online pr