CVE-2023-22463

Description

KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys in github.com/KubeOperator/kubepi

How to fix CVE-2023-22463

To remediate CVE-2023-22463, upgrade the affected package to a fixed version below.

• Go/github.com/KubeOperator/kubepi—upgrade to 1.6.3 or later
• —upgrade to 1.6.3 or later

Is CVE-2023-22463 being exploited?

Likely — EPSS is 91.5%, placing CVE-2023-22463 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (2)

• from 0, < 1.6.3
• from 0, < 1.6.3

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-22463
• PATCHgithub.com/KubeOperator/KubePi
• WEBgithub.com/KubeOperator/KubePi/blob/da784f5532ea2495b92708cacb32703bff3a45a3/internal/api/v1/session/session.go#L35
• WEBgithub.com/KubeOperator/KubePi/commit/3be58b8df5bc05d2343c30371dd5fcf6a9fbbf8b