CVE-2023-22479

Published: Jan 10, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.

Affected (1)

Products: Fit2cloud: Kubepi

Fit2cloud

1 product

Kubepi

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fit2cloud Kubepi	Before 1.6.4

Related CWEs

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (2)

https://github.com/KubeOperator/KubePi/security/advisories/GHSA-v4w5-r2xc-7f8h

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/KubeOperator/KubePi/security/advisories/GHSA-v4w5-r2xc-7f8h

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.