CVE-2023-22479 KubePi vulnerable to session fixation attack

2023-01-1020:34:08

CWE-384

GitHub_M

www.cve.org

kubepi

session fixation

vulnerability

patch

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

31.2%

JSON

KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.

CNA Affected

[
  {
    "vendor": "KubeOperator",
    "product": "KubePi",
    "versions": [
      {
        "version": "<= 1.6.3",
        "status": "affected"
      }
    ]
  }
]