CVE-2023-22478

KubePi is vulnerable to missing authorization

HIGH 7.5EPSS 3.6%

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.

Affected: KubeOperator · KubePi
CVSS v3.1 NVD: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v3.1 GITHUB: 7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS: 3.57% chance of exploitation in the next 30 days, 89th percentile
Nuclei: high · CWE-862
Published: 2023-01-14
Updated: 2025-03-10

Nuclei templates (1)

projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22478.yaml

Security advisories

KubeOperator/KubePi/releases/tag/v1.6.4
KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4
advisories/GHSA-gqx8-hxmv-c4v4

References

CVE Record
NVD entry