CVE-2023-22479: KubePi vulnerable to session fixation attack
Summary A session fixation attack allows an attacker to hijack a legitimate user session. The attack investigates a flaw in how the online application handles the session ID, especially the susceptible web application.
Affected Version <= v1.6.3
Patches The vulnerability has been fixed in v1.6.4.
https://github.com/KubeOperator/KubePi/commit/1e9c550356c1a425a742480efcf743d373e98dcb : A session fixation attack allows an attacker to hijack a legitimate user session.
Workarounds It is recommended to upgrade the version to v1.6.4.
For more information If you have any questions or comments about this advisory, please open an issue.
This vulnerability is reported by sachinh09 from huntr.dev.
Other sources
KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-22479?
CVE-2023-22479 is a vulnerability that allows an attacker to hijack a legitimate user session in KubePi, a Kubernetes panel.
What is the severity of CVE-2023-22479?
The severity of CVE-2023-22479 is high with a CVSS score of 7.5.
How does CVE-2023-22479 affect KubePi?
CVE-2023-22479 affects KubePi versions up to v1.6.3.
How can I fix CVE-2023-22479?
To fix CVE-2023-22479, update KubePi to version 1.6.4 or later.
Is there any additional information available about CVE-2023-22479?
Additional information about CVE-2023-22479 can be found in the references provided: [GitHub Advisory](https://github.com/KubeOperator/KubePi/security/advisories/GHSA-v4w5-r2xc-7f8h) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-22479).