PT-2023-18530 · Kubepi · Kubepi

Suanve · Published 2023-01-09 · Updated 2024-08-20 · CVE-2023-22478

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 1.6.4

Description The issue allows unauthorized access to system API interfaces, potentially leaking sensitive information. This is due to a flaw in how online applications handle routing permissions. There are no known workarounds.

Recommendations For versions prior to 1.6.4, upgrade to version 1.6.4 to resolve the issue. As a temporary workaround, consider restricting access to the API interfaces until the upgrade is applied.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-22478

GHSA-GQX8-HXMV-C4V4

GO-2023-1463

Affected Products

Kubepi

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22478.json · Exploit
• https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6 · Patch
• https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4 · Patch
• https://osv.dev/vulnerability/GO-2023-1463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22478 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22478 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gqx8-hxmv-c4v4 · Vendor Advisory
• https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4 · Note
• https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4 · Note
• https://github.com/KubeOperator/KubePi · Note