What is GHSA-v4w5-r2xc-7f8h?

GHSA-v4w5-r2xc-7f8h is a security advisory published by GitHub Security Advisories with High severity. KubePi session fixation attack allows an attacker to hijack a legitimate user session.

Which CVE IDs does GHSA-v4w5-r2xc-7f8h cover?

GHSA-v4w5-r2xc-7f8h covers the following CVE IDs: CVE-2023-22479. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v4w5-r2xc-7f8h?

GHSA-v4w5-r2xc-7f8h has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-v4w5-r2xc-7f8h?

GHSA-v4w5-r2xc-7f8h affects 1 product, including: go/github.com/KubeOperator/kubepi:\u003c= 1.6.3.

GHSA-v4w5-r2xc-7f8hHighCVSS 7.5

KubePi session fixation attack allows an attacker to hijack a legitimate user session.

Vendor

GitHub Security Advisories

Published

January 9, 2023

Last Modified

July 21, 2023

🔗 CVE IDs covered (1)

CVE-2023-22479 →

📋 Description

Summary

A session fixation attack allows an attacker to hijack a legitimate user session. The attack investigates a flaw in how the online application handles the session ID, especially the susceptible web application.

Affected Version

<= v1.6.3

Patches

The vulnerability has been fixed in v1.6.4.

https://github.com/KubeOperator/KubePi/commit/1e9c550356c1a425a742480efcf743d373e98dcb : A session fixation attack allows an attacker to hijack a legitimate user session.

Workarounds

It is recommended to upgrade the version to v1.6.4.

For more information

If you have any questions or comments about this advisory, please open an issue.

This vulnerability is reported by sachinh09 from huntr.dev.

🎯 Affected products1

go/github.com/KubeOperator/kubepi:<= 1.6.3