Lucene search
GoogleOSV:GHSA-757P-VX43-FP9RHistoryJul 21, 2023 - 8:18 p.m.
KubePi Privilege Escalation vulnerability
2023-07-2120:18:00
Google
osv.dev
1
kubepi
privilege escalation
user permissions
admin
request
impact
software
Summary
A normal user has permission to create/update users, they can become admin by editing the isadmin value in the request
PoC
Change the value of the isadmin field in the request to true:
https://drive.google.com/file/d/1e8XJbIFIDXaFiL-dqn0a0b6u7o3CwqSG/preview
Impact
Elevate user privileges
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/kubeoperator/kubepi | lt | 1.6.5 |
Related
gitlab
gitlab
Improper Access Control
2023-07-21 00:00:00
Improper Access Control
2023-07-21 00:00:00
cvelist
cvelist
CVE-2023-37917 Privilege Escalation in kubepi
2023-07-21 20:13:22
osv
osv
CVE-2023-37917
2023-07-21 21:15:11
cve
cve
CVE-2023-37917
2023-07-21 21:15:11
prion
prion
Server side request forgery (ssrf)
2023-07-21 21:15:00
veracode
veracode
Privilege Escalation
2023-07-25 06:07:11
github
github
KubePi Privilege Escalation vulnerability
2023-07-21 20:18:00