CVE-2023-37917 CRITICAL

CVE-2023-37917: Privilege Escalation in kubepi

Vendor 1Panel-Dev
Product KubePi
Weakness CWE-269
Published July 21, 2023
Last update October 10, 2024
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

What the vulnerability does

01Description

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Key dates

02Disclosure timeline

July 21, 2023 CVE published
October 10, 2024 Record updated