CVE-2023-37916

Published: Jul 21, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected (1)

Products: Fit2cloud: Kubepi

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fit2cloud Kubepi	Before 1.6.5

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-87f6-8gr7-pc6h

Source: security-advisories@github.com

ExploitThird Party Advisory

https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-87f6-8gr7-pc6h

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.