What is GHSA-757p-vx43-fp9r?

GHSA-757p-vx43-fp9r is a security advisory published by GitHub Security Advisories with Critical severity. KubePi Privilege Escalation vulnerability

Which CVE IDs does GHSA-757p-vx43-fp9r cover?

GHSA-757p-vx43-fp9r covers the following CVE IDs: CVE-2023-37917. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-757p-vx43-fp9r?

GHSA-757p-vx43-fp9r has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-757p-vx43-fp9r?

GHSA-757p-vx43-fp9r affects 1 product, including: go/github.com/KubeOperator/kubepi:\u003c 1.6.5.

GHSA-757p-vx43-fp9rCriticalCVSS 9.1

KubePi Privilege Escalation vulnerability

Vendor

GitHub Security Advisories

Published

July 21, 2023

Last Modified

November 8, 2023

🔗 CVE IDs covered (1)

CVE-2023-37917 →

📋 Description

Summary

A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request

PoC

Change the value of the isadmin field in the request to true: https://drive.google.com/file/d/1e8XJbIFIDXaFiL-dqn0a0b6u7o3CwqSG/preview

Impact

Elevate user privileges

🎯 Affected products1

go/github.com/KubeOperator/kubepi:< 1.6.5

🔗 References (5)

https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-757p-vx43-fp9r
https://drive.google.com/file/d/1e8XJbIFIDXaFiL-dqn0a0b6u7o3CwqSG/preview
https://github.com/1Panel-dev/KubePi/releases/tag/v1.6.5
https://nvd.nist.gov/vuln/detail/CVE-2023-37917
https://github.com/advisories/GHSA-757p-vx43-fp9r