Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Privilege Escalation in kubepi
Vulnerability Description
KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Vulnerability Type
特权管理不恰当
Vulnerability Title
KubePi 安全漏洞
Vulnerability Description
KubePi是一个K8s面板。它允许管理员导入多个Kubernetes集群，并且通过权限控制，将不同cluster、namespace的权限分配给指定用户。 KubePi 1.6.5之前版本存在安全漏洞，该漏洞源于普通用户有权创建/更新用户，他们可以通过编辑请求中的isadmin值来成为管理员。
CVSS Information
N/A
Vulnerability Type
N/A