PT-2023-18530 · Kubepi · Kubepi

Suanve · Publicado 2023-01-09 · Atualizado 2024-08-20 · CVE-2023-22478

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 1.6.4

Description The issue allows unauthorized access to system API interfaces, potentially leaking sensitive information. This is due to a flaw in how online applications handle routing permissions. There are no known workarounds.

Recommendations For versions prior to 1.6.4, upgrade to version 1.6.4 to resolve the issue. As a temporary workaround, consider restricting access to the API interfaces until the upgrade is applied.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-22478

GHSA-GQX8-HXMV-C4V4

GO-2023-1463

Produtos afetados

Kubepi

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22478.json · Exploit
• https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4 · Nota
• https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6 · Correção
• https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4 · Nota
• https://github.com/KubeOperator/KubePi · Nota
• https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4 · Correção
• https://osv.dev/vulnerability/GO-2023-1463 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-22478 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-22478 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gqx8-hxmv-c4v4 · Aviso do Fabricante