Vulnerability-Lookup

CVE-2023-22478 (GCVE-0-2023-22478)

Vulnerability from cvelistv5 – Published: 2023-01-14 00:22 – Updated: 2025-03-10 21:29

Previdian

Title

KubePi is vulnerable to missing authorization

Summary

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-10 20:59 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/KubeOperator/KubePi/security/a…	x_refsource_CONFIRM
https://github.com/KubeOperator/KubePi/commit/0c6…	x_refsource_MISC
https://github.com/KubeOperator/KubePi/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
KubeOperator	KubePi	Affected: <= 1.6.3

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: cad51494-3743-45cf-9602-a796e739fcad

Vulnerability ID: CVE-2023-22478

Status: Confirmed

Status Updated: 2025-07-07 02:00 CEST

Exploited: Yes

Timestamps

First Seen: 2025-07-07

Asserted: 2025-07-07

Scope

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	KubePi is vulnerable to missing authorization
Cve Id	CVE-2023-22478
Vendor	KubeOperator
Ghsa Id	GHSA-GQX8-HXMV-C4V4
Product	KubePi
Added Date	2025-07-07T00:00:00.000Z
Cvss Score	7.3
Epss Score	0.03573
Previous Ids
Cvss Severity	HIGH
Virtual Patch	False
Cvss Estimated	False
Epss Percentile	0.88992
Used In Malware	unknown
Vulnerability Id	CVE-2023-22478
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-10-02 09:09 CEST | Updated: 2026-10-02 09:09 CEST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:13:48.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4"
          },
          {
            "name": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6"
          },
          {
            "name": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-22478",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T20:59:36.793716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-10T21:29:57.856Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "KubePi",
          "vendor": "KubeOperator",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.6.3 "
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-14T00:22:54.146Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4"
        },
        {
          "name": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6"
        },
        {
          "name": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4"
        }
      ],
      "source": {
        "advisory": "GHSA-gqx8-hxmv-c4v4",
        "discovery": "UNKNOWN"
      },
      "title": "KubePi is vulnerable to missing authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-22478",
    "datePublished": "2023-01-14T00:22:54.146Z",
    "dateReserved": "2022-12-29T17:41:28.087Z",
    "dateUpdated": "2025-03-10T21:29:57.856Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-22478",
      "date": "2026-10-07",
      "epss": "0.03573",
      "percentile": "0.8905"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "KubePi",
                "vendor": "KubeOperator",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c= 1.6.3 "
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:fit2cloud:kubepi:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A6B7CC4D-D5A0-4221-854C-2F37D2BB873C",
                    "versionEndExcluding": "1.6.4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds."
          },
          {
            "lang": "es",
            "value": "KubePi es un panel de Kubernetes moderno. La API interact\u00faa con entidades no autorizadas y puede filtrar informaci\u00f3n confidencial. Este problema se solucion\u00f3 en la versi\u00f3n 1.6.4. Actualmente no se conocen workarounds."
          }
        ],
        "id": "CVE-2023-22478",
        "lastModified": "2026-06-17T05:35:32.757",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-22478",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T20:59:36.793716Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-01-14T01:15:14.637",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T10:13:48.550Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4"
              },
              {
                "name": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6"
              },
              {
                "name": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-22478",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-03-10T20:59:36.793716Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-03-10T20:59:38.188Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "KubePi",
              "vendor": "KubeOperator",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c= 1.6.3 "
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-01-14T00:22:54.146Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4"
            },
            {
              "name": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6"
            },
            {
              "name": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4"
            }
          ],
          "source": {
            "advisory": "GHSA-gqx8-hxmv-c4v4",
            "discovery": "UNKNOWN"
          },
          "title": "KubePi is vulnerable to missing authorization"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2023-22478",
        "datePublished": "2023-01-14T00:22:54.146Z",
        "dateReserved": "2022-12-29T17:41:28.087Z",
        "dateUpdated": "2025-03-10T21:29:57.856Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

EUVD-2026-221681

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 06:50

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T06:50:59.432578+00:00",
  "id": "EUVD-2026-221681"
}

FKIE_CVE-2023-22478

Vulnerability from fkie_nvd - Published: 2023-01-14 01:15 - Updated: 2026-06-17 05:35

Previdian

Severity

7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4	Release Notes, Third Party Advisory
security-advisories@github.com	https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4	Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4	Patch, Third Party Advisory

Impacted products

	Vendor	Product	Version
	fit2cloud	kubepi	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "KubePi",
          "vendor": "KubeOperator",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.6.3 "
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fit2cloud:kubepi:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6B7CC4D-D5A0-4221-854C-2F37D2BB873C",
              "versionEndExcluding": "1.6.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds."
    },
    {
      "lang": "es",
      "value": "KubePi es un panel de Kubernetes moderno. La API interact\u00faa con entidades no autorizadas y puede filtrar informaci\u00f3n confidencial. Este problema se solucion\u00f3 en la versi\u00f3n 1.6.4. Actualmente no se conocen workarounds."
    }
  ],
  "id": "CVE-2023-22478",
  "lastModified": "2026-06-17T05:35:32.757",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-22478",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-03-10T20:59:36.793716Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-01-14T01:15:14.637",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GQX8-HXMV-C4V4

Vulnerability from github – Published: 2023-01-09 21:56 – Updated: 2023-01-24 23:29

Summary

KubePi may allow unauthorized access to system API

Details

Summary

Unauthorized access refers to the ability to bypass the system's preset permission settings to access some API interfaces. The attack exploits a flaw in how online applications handle routing permissions.

Affected Version

<= v1.6.3

Patches

The vulnerability has been fixed in v1.6.4.

https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6

Workarounds

It is recommended to upgrade the version to v1.6.4.

For more information

If you have any questions or comments about this advisory, please open an issue.

References

https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.6.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/KubeOperator/kubepi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-22478"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-09T21:56:09Z",
    "nvd_published_at": "2023-01-14T01:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nUnauthorized access refers to the ability to bypass the system\u0027s preset permission settings to access some API interfaces. The attack exploits a flaw in how online applications handle routing permissions.\n\n### Affected Version\n\u003c= v1.6.3\n\n### Patches\nThe vulnerability has been fixed in v1.6.4.\n\nhttps://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6\n\n### Workarounds\nIt is recommended to upgrade the version to v1.6.4.\n\n### For more information\nIf you have any questions or comments about this advisory, please open an issue.\n\n### References\nhttps://github.com/KubeOperator/KubePi/releases/tag/v1.6.4",
  "id": "GHSA-gqx8-hxmv-c4v4",
  "modified": "2023-01-24T23:29:03Z",
  "published": "2023-01-09T21:56:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22478"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/KubeOperator/KubePi"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "KubePi may allow unauthorized access to system API"
}

GSD-2023-22478

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-22478

Aliases

CVE-2023-22478

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-22478",
    "id": "GSD-2023-22478"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-22478"
      ],
      "details": "KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.",
      "id": "GSD-2023-22478",
      "modified": "2023-12-13T01:20:42.563317Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-22478",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "KubePi",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c= 1.6.3 "
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "KubeOperator"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-862",
                "lang": "eng",
                "value": "CWE-862: Missing Authorization"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4",
            "refsource": "MISC",
            "url": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4"
          },
          {
            "name": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6",
            "refsource": "MISC",
            "url": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6"
          },
          {
            "name": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4",
            "refsource": "MISC",
            "url": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-gqx8-hxmv-c4v4",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003cv1.6.4",
          "affected_versions": "All versions before 1.6.4",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-862",
            "CWE-937"
          ],
          "date": "2023-01-24",
          "description": "KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.",
          "fixed_versions": [
            "v1.6.4"
          ],
          "identifier": "CVE-2023-22478",
          "identifiers": [
            "CVE-2023-22478",
            "GHSA-gqx8-hxmv-c4v4",
            "GMS-2023-5"
          ],
          "not_impacted": "",
          "package_slug": "go/github.com/KubeOperator/KubePi",
          "pubdate": "2023-01-14",
          "solution": "Upgrade to version 1.6.4 or above.",
          "title": "Missing Authorization",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2023-22478",
            "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6",
            "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4",
            "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4",
            "https://github.com/advisories/GHSA-gqx8-hxmv-c4v4"
          ],
          "uuid": "ceaee063-a4be-42e5-ae21-97e497d15d52",
          "versions": [
            {
              "commit": {
                "sha": "87e4eca94bc53c7c7671e8fac15cfc452d805e63",
                "tags": [
                  "v1.6.4"
                ],
                "timestamp": "20230111070141"
              },
              "number": "v1.6.4"
            }
          ]
        },
        {
          "affected_range": "\u003c0",
          "affected_versions": "All versions up to 1.6.3",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2023-01-09",
          "description": "API interfaces with unauthorized access will leak sensitive information via `/kubepi/api/v1/systems/operation/logs/search` and `/kubepi/api/v1/systems/login/logs/search`",
          "fixed_versions": [],
          "identifier": "GMS-2023-5",
          "identifiers": [
            "GHSA-gqx8-hxmv-c4v4",
            "GMS-2023-5",
            "CVE-2023-22478"
          ],
          "not_impacted": "",
          "package_slug": "go/github.com/KubeOperator/kubepi",
          "pubdate": "2023-01-09",
          "solution": "Unfortunately, there is no solution available yet.",
          "title": "Duplicate of ./go/github.com/KubeOperator/KubePi/CVE-2023-22478.yml",
          "urls": [
            "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4",
            "https://github.com/advisories/GHSA-gqx8-hxmv-c4v4"
          ],
          "uuid": "d10b7708-6d9f-4a68-ba61-fe85425c142c",
          "versions": [
            {
              "commit": {
                "sha": "eead48749050a1bc47c710acb8267211a387a85d",
                "tags": [
                  "v1.6.3"
                ],
                "timestamp": "20230104102835"
              },
              "number": "v1.6.3"
            }
          ]
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:fit2cloud:kubepi:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.6.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-22478"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-862"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6"
            },
            {
              "name": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4",
              "refsource": "MISC",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4"
            },
            {
              "name": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-01-24T18:39Z",
      "publishedDate": "2023-01-14T01:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-22478 (GCVE-0-2023-22478)

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: previdian

Details

References

EUVD-2026-221681

FKIE_CVE-2023-22478

GHSA-GQX8-HXMV-C4V4

Summary

Affected Version

Patches

Workarounds

For more information

References

GSD-2023-22478

Tags

Sightings

Nomenclature

Related by attack behaviour