CVE-2023-37917 — Privilege Escalation in kubepi

CVE-2023-37917

Privilege Escalation in kubepi PUBLISHED

Description (CNA)

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected (CNA)

Vendor / product	Versions
1Panel-dev / KubePi	affected < 1.6.5

CWE

CWE-269

References

https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-757p-vx43-fp9r

ADP enrichment

CVE

No English description supplied.

https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-757p-vx43-fp9r

CISA-ADP

No English description supplied.

No references supplied.