CVE-2023-37917

2023-07-2121:15:11

Google

osv.dev

kubepi

kubernetes

management panel

privilege escalation

upgrade

vulnerability

advisory

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.5%

JSON

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CPENameOperatorVersion
kubepieq1.2.0
kubepieq1.3.0
kubepieq1.1.2
kubepieq1.5.2
kubepieq1.1.1
kubepieq1.0.0
kubepieq1.4.1
kubepieq1.5.0
kubepieq1.1.0
kubepieq1.6.4