1Panel-Dev Kubepi vulnerabilities

CVE-2024-36111 [MEDIUM] CWE-1259 CVE-2024-36111: KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in th KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the key is detected to be empty in the configuration file r

CVE-2023-37917 [HIGH] CWE-269 CVE-2023-37917: KubePi is an opensource kubernetes management panel. A normal user has permission to create/update u KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for t

CVE-2023-37916 [HIGH] CWE-200 CVE-2023-37916: KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNu KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workaround