GitHub Advisoryadvisory · Go
GHSA-87f6-8gr7-pc6h KubePi may leak password hash of any user
MEDIUM
Official page ↗
- Aliases
- CVE-2023-37916
- Ecosystem
- Go
- Packages
- github.com/KubeOperator/kubepi
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2023-07-21
Affected packages
• Go github.com/KubeOperator/kubepi: < 1.6.5 → fixed in 1.6.5
Description
Summary
http://kube.pi/kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password of any user (including admin). This leads to password crack attack
PoC
https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview
Impact
• Leaking confidential information.
• Can lead to password cracking attacks
Related
Alias · CVE (1)
- CVE-2023-37916 KubePi is an opensource kubernetes management panel. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-87f6-8gr7-pc6h web
- https://nvd.nist.gov/vuln/detail/CVE-2023-37916 advisory
- https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview web
- https://github.com/1Panel-dev/KubePi package
- https://github.com/1Panel-dev/KubePi/releases/tag/v1.6.5 web