{"id":"CVE-2023-37916","aliases":["EUVD-2023-2000","GHSA-87f6-8gr7-pc6h","GO-2023-1957"],"status":"published","title":"Leak password hash of any user","description":"KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1\u0026\u0026pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00814,"percentile":0.57476,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2023-07-21T20:15:12Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"Go","package":"github.com/KubeOperator/kubepi","fixed_in":["1.6.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/KubeOperator/kubepi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/KubeOperator/kubepi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/KubeOperator/kubepi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.5"}]}]}],"products":[{"vendor":"1panel-dev","product":"kubepi"},{"vendor":"fit2cloud","product":"kubepi"}],"references":[{"url":"https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-87f6-8gr7-pc6h","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview","tags":["web"]},{"url":"https://github.com/1Panel-dev/KubePi/releases/tag/v1.6.5","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37916","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-87f6-8gr7-pc6h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37916.json","tags":["advisory"]},{"url":"https://github.com/1Panel-dev/KubePi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-37916","title":"Leak password hash of any user","description":"KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1\u0026\u0026pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-07-21T20:15:12.05Z","modified":"2024-10-10T18:36:15.48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:35:16.454633Z"}],"euvd":[{"id":"EUVD-2023-2000","description":"KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1\u0026\u0026pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-07-21T20:15:12Z","modified":"2024-10-10T18:36:15Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:27:40.113019Z"}],"ghsa":[{"id":"GHSA-87f6-8gr7-pc6h","title":"KubePi may leak password hash of any user","description":"### Summary\nhttp://kube.pi/kubepi/api/v1/users/search?pageNum=1\u0026\u0026pageSize=10 leak password of any user (including admin). This leads to password crack attack\n\n\n### PoC\nhttps://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview\n\n### Impact\n- Leaking confidential information.\n- Can lead to password cracking attacks\n","status":"published","published":"2023-07-21T20:18:09Z","modified":"2023-11-08T05:04:49Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:16.721714Z"}],"nvd":[{"id":"CVE-2023-37916","description":"KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1\u0026\u0026pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-07-21T21:15:11.487Z","modified":"2026-06-17T06:08:53.843Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:08:17.044696Z"}],"osv":[{"id":"CVE-2023-37916","title":"Leak password hash of any user","description":"KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1\u0026\u0026pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue has been addressed in version 1.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-07-21T20:15:12.05Z","modified":"2026-10-28T02:30:23.356046505Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"GHSA-87f6-8gr7-pc6h","title":"KubePi may leak password hash of any user","description":"### Summary\nhttp://kube.pi/kubepi/api/v1/users/search?pageNum=1\u0026\u0026pageSize=10 leak password of any user (including admin). This leads to password crack attack\n\n\n### PoC\nhttps://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview\n\n### Impact\n- Leaking confidential information.\n- Can lead to password cracking attacks\n","status":"published","published":"2023-07-21T20:18:09Z","modified":"2026-09-10T03:49:42.593391229Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"GO-2023-1957","title":"KubePi may leak password hash of any user in github.com/KubeOperator/kubepi","description":"KubePi may leak password hash of any user in github.com/KubeOperator/kubepi","status":"published","published":"2024-08-20T20:32:20Z","modified":"2026-03-03T04:54:02.662649Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}