CVE-2023-37917

Published: Jul 21, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected (1)

Products: Fit2cloud: Kubepi

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fit2cloud Kubepi	Before 1.6.5

Related CWEs

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (2)

https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-757p-vx43-fp9r

Source: security-advisories@github.com

ExploitThird Party Advisory

https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-757p-vx43-fp9r

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.