CVE-2023-37916

MediumCVSS 6.5

Published: 21/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.68%

48th percentile - higher than 48% of all known CVEs

Summary

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leaks password hashes of users, including admins, which may allow an attacker to crack them.

Risk Assessment

The exposure of password hashes poses a risk that an attacker could gain access to user accounts, including administrative accounts, potentially leading to serious security breaches.

Recommendation

It is recommended to upgrade to version 1.6.5 to mitigate this vulnerability. There are no known workarounds for this issue.

Original NVD description (English source)

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.