Executive brief
KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys in github.com/KubeOperator/kubepi
Affected products
- Go github.com/KubeOperator/kubepi
Junglewise Threat Intelligence
CVE-2023-22463: GO-2023-1283 - KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys in github.com/KubeOperator/kubepi
CVE-2023-22463 · Severity: low · CVSS 3 · Published 2024-08-20
Technologies: github.com/KubeOperator/kubepi (Go). Vendors: Go.
Related threats
- GO-2023-1956 - KubePi Privilege Escalation vulnerability in github.com/KubeOperator/kubepi
- GO-2023-1957 - KubePi may leak password hash of any user in github.com/KubeOperator/kubepi
- GO-2023-1468 - KubePi session fixation attack allows an attacker to hijack a legitimate user session. in github.com/KubeOperator/kubepi
- GO-2023-1463 - KubePi may allow unauthorized access to system API in github.com/KubeOperator/kubepi