cve.bz

CVE-2023-37916

7.5 highEPSS 0.8%

High (7.5) in fit2cloud kubepi. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in github.com/KubeOperator/kubepi 1.6.5.

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE
CWE-200
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-87f6-8gr7-pc6hGogithub.com/KubeOperator/kubepi<1.6.51.6.5
GO-2023-1957Gogithub.com/KubeOperator/kubepi<1.6.51.6.5

References

Check your stackJSON