CVE-2023-37916CWE-200

Leak password hash of any user

Medium · published July 21, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
56.6
In the wild
Unconfirmed
What it is

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00814 · 56.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-07-21T20:15Z
EPSS history
Timeline
  • 21 JUL 20:15Z
    Leak password hash of any user
    cvelistv5