SB2023010938 - Multiple vulnerabilities in KubePi

Description

This security bulletin contains information about 2 vulnerabilities.

1) Session Fixation (CVE-ID: N/A)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to hijack a legitimate user session.

The vulnerability exists due to improper session management in the session handling mechanism when a victim uses a fixed session identifier. A remote attacker can conduct a session fixation attack to hijack a legitimate user session.

User interaction is required.

2) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain unauthorized access to system API functionality.

The vulnerability exists due to improper access control in the system API when handling requests. A remote attacker can send crafted requests to gain unauthorized access to system API functionality.

Remediation

Install update from vendor's website.

References

• https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-v4w5-r2xc-7f8h
• https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4