CVE-2023-22478highobserved exploitationCWE-862

CVE-2023-22478: high-severity vulnerability in KubeOperator KubePi

KubePi is vulnerable to missing authorization

Published · Updated

Follow this CVE+ Monitor KubePi+ Monitor github.com/KubeOperator/kubepi

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 7.3epss 3.7%
from disclosure to weapon
Published on NVDJan 14
VulnCheck+324d
KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
KubeOperator · KubePi
Related CVEs — KubeOperator KubePi

In the same product, most dangerous first.

CVE-2023-22463CRITICALKubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token EPSS 69.7%CVE-2023-22479HIGHKubePi vulnerable to session fixation attack EPSS 0.4%