PT-2023-26183 · Kubepi · Kubepi

Ch1Nhpd · Publicado 2023-07-21 · Atualizado 2024-08-20 · CVE-2023-37916

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 1.6.5

Description The issue concerns the leakage of password hashes for any user, including administrators, through the /kubepi/api/v1/users/search endpoint. This could allow a motivated attacker to crack the leaked password hashes, potentially leading to unauthorized access. The problem is associated with leaking confidential information and can lead to password cracking attacks.

Recommendations For versions prior to 1.6.5, upgrade to version 1.6.5 to address the issue. As a temporary workaround, consider restricting access to the /kubepi/api/v1/users/search endpoint until the upgrade is possible. Avoid using the pageNum and pageSize parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2023-37916

GHSA-87F6-8GR7-PC6H

GO-2023-1957

Produtos afetados

Kubepi

Referências · 9

• 🔥 https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-87f6-8gr7-pc6h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37916.json · Exploit
• https://github.com/1Panel-dev/KubePi · Nota
• https://github.com/1Panel-dev/KubePi/releases/tag/v1.6.5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-37916 · Nota de Segurança
• https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview · Nota
• https://osv.dev/vulnerability/CVE-2023-37916 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-87f6-8gr7-pc6h · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-1957 · Aviso do Fabricante