CVE-2023-37917criticalCWE-269

CVE-2023-37917: fallo crítico en 1Panel-dev KubePi

Privilege Escalation in kubepi

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear KubePi+ Monitorear github.com/KubeOperator/kubepi

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 0.7%
KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Productos afectados
1Panel-dev · KubePi
CVEs relacionadas — 1Panel-dev KubePi

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-36111MEDIUMKubePi's JWT token validation has a defectEPSS 8.4%CVE-2023-37916MEDIUMLeak password hash of any userEPSS 0.8%CVE-2026-65956CRITICALKubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRFEPSS 0.6%CVE-2026-69129MEDIUMKubePi: Insufficient per-cluster authorization checks in cluster management APIsEPSS 0.4%