by Kastro
Paper/Archive/CVE-2023-25156

CVE-2023-25156

kiwitcms kiwi — Kiwi TCMS has no protection against brute-force attacks on login page

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.0.600 × 2012.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.

Affected

ProductAffectedFixed inSource
kiwi12.0 – < 12.012.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refhuntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795refkiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120refgithub.com/kiwitcms/Kiwi/security/advisories/GHSA-7968-h4m4-ghm9refgithub.com/kiwitcms/Kiwi/commit/0ed213fa0ddb7a6dc77e3c3b99e8fc90ccdaf46f