CVE-2023-37916: Exposure of Sensitive Information to an Unauthorized Actor

July 21, 2023 (updated July 31, 2023)

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

github.com/1Panel-dev/KubePi/security/advisories/GHSA-87f6-8gr7-pc6h
nvd.nist.gov/vuln/detail/CVE-2023-37916

Detect and mitigate CVE-2023-37916 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →