by Kastro
Paper/Archive/CVE-2023-37917

CVE-2023-37917

1Panel-dev KubePi — Privilege Escalation in kubepi

EPSS 0.7%public exploitCVSS 9.1
critical.is priorityof 100
48
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 54.7.547 × 2010.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected

ProductAffectedFixed inSource
KubePi< 1.6.5–CNA
kubepi< 1.6.51.6.5CISA-ADP

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/1Panel-dev/KubePi/security/advisories/GHSA-757p-vx43-fp9r