CVE-2023-37917

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-37917

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-37917.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2023-37917

Aliases

Published

2023-07-21T20:13:22.401Z

Modified

2025-11-29T14:23:56.941495Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L CVSS Calculator

Summary

Privilege Escalation in kubepi

Details

KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-269"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37917.json"
}

References

Affected packages

Git / github.com/1panel-dev/kubepi

Affected ranges

Type

GIT

Repo

https://github.com/1panel-dev/kubepi

Events

Introduced

Fixed

1877e5349b55a69a86d434d061e13340410f8658

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.6.5"
        }
    ]
}

Affected versions

v1.*

v1.0.0

v1.0.1

v1.1.0

v1.1.1

v1.1.2

v1.2.0

v1.2.1

v1.3.0

v1.4.0

v1.4.1

v1.4.2

v1.5.0

v1.5.1

v1.5.2

v1.5.3

v1.6.0

v1.6.1

v1.6.2

v1.6.3

v1.6.4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-37917.json"

Git / github.com/kubeoperator/kubepi