CVE-2023-37917: Improper Access Control

July 21, 2023 (updated July 31, 2023)

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

github.com/1Panel-dev/KubePi/security/advisories/GHSA-757p-vx43-fp9r
nvd.nist.gov/vuln/detail/CVE-2023-37917

Detect and mitigate CVE-2023-37917 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →