CVE-2023-22478

HIGH EXPLOITED NUCLEI

KubePi < 1.6.4 - Missing Authorization

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-22478 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.

Nuclei Templates (1)

KubePi <= v1.6.4 LoginLogsSearch - Unauthorized Access
HIGHVERIFIEDby DhiyaneshDk
Shodan: html:"kubepi" || http.html:"kubepi"
FOFA: kubepi || body="kubepi"

References (3)

Core 3
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4

Scores

CVSS v3 7.3
EPSS 0.0357
EPSS Percentile 87.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2023-12-04
CWE
CWE-862
Status published
Products (2)
fit2cloud/kubepi < 1.6.4
KubeOperator/kubepi 0 - 1.6.4Go
Published Jan 14, 2023
Tracked Since Feb 18, 2026