CVE-2023-37916
KubePi may leak password hash of any user
概要
KubePi may leak password hash of any user
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Summary
http://kube.pi/kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password of any user (including admin). This leads to password crack attack
PoC
https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview
Impact
- Leaking confidential information.
- Can lead to password cracking attacks
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Go
github.com/KubeOperator/kubepi
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.5"}]}]
参照URL
- advisory nvd.nist.gov
- package github.com
- web github.com
- web drive.google.com
- web github.com