github.com/KubeOperator/kubepi
Go5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/KubeOperator/kubepipage 1 of 1
- CVE-2023-22463CRITICALCVSS 9.8EG 9.8✓ Fixed in 1.6.32023-01-04
KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over t…
- CVE-2023-22478HIGHCVSS 7.3EG 7.3✓ Fixed in 1.6.42023-01-14
KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
- CVE-2023-22479HIGHCVSS 7.5EG 7.5✓ Fixed in 1.6.42023-01-10
KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.
- CVE-2023-37916MEDIUMCVSS 6.5EG 6.5✓ Fixed in 1.6.52023-07-21
KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password h…
- CVE-2023-37917CRITICALCVSS 9.1EG 9.1✓ Fixed in 1.6.52023-07-21
KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. …
Check whether github.com/KubeOperator/kubepi is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/KubeOperator/kubepi CVEs against the assets you own.
Start Free Scan →