CVE-2023-22478

HIGHNuclei

KubePi is vulnerable to missing authorization

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-22478 has a selected CVSS score of 7.3 (high); EIP currently links 1 Nuclei template.

Description

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 4, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 10, 2025 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

KubePi

Browse KubeOperator / KubePi
CVE List<= 1.6.3affected

kubepi

Browse fit2cloud / kubepi
VulnCheckVersion data not supplied

github.com/KubeOperator/kubepi

Browse Go / github.com/KubeOperator/kubepi
GitHub AdvisoryBefore 1.6.4 · Fixed in 1.6.4affected

Nuclei templates

1
ProjectDiscoveryHIGHKubePi <= v1.6.4 LoginLogsSearch - Unauthorized AccessCVSS 7.5

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.

Impact

An attacker can gain unauthorized access to sensitive information.

Remediation

Upgrade KubePi to a version higher than v1.6.4 to mitigate the vulnerability.

WeaknessesCWE-862
AuthorsDhiyaneshDk
Template tagscve2023cvekubepik8sexposurefit2cloudvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:fit2cloud:kubepi:*:*:*:*:*:*:*:*
Shodan: html:"kubepi"
Shodan: http.html:"kubepi"
FOFA: kubepi
FOFA: body="kubepi"
https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/webapp/KubePi/KubePi%20LoginLogsSearch%20%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E%20CVE-2023-22478.md https://nvd.nist.gov/vuln/detail/CVE-2023-22478 https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4 https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6 https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4

Source: ProjectDiscovery

References

6