CVE-2023-22478

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
KubeOperator	KubePi	<= 1.6.3

References

https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6Patch, Third Party Advisory
https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4Release Notes, Third Party Advisory
https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4Patch, Third Party Advisory
https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6Patch, Third Party Advisory
https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4Release Notes, Third Party Advisory
https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4Patch, Third Party Advisory

Timeline

Published: Jan 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-224796.5KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and be CVE-2023-224809.8KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters CVE-2023-224815.5FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in `users/_/log_api.txt`CVE-2023-224828.8Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.CVE-2023-224837.5cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject CVE-2023-224847.5cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject CVE-2023-224855.3cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted CVE-2023-224867.5cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a CVE-2023-224874.3Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention CVE-2023-224885.4Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass acc CVE-2023-224893.5Flarum is a discussion platform for websites. If the first post of a discussion is permanently deleted but the discussion stays visible, any CVE-2023-22498.8The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions