CVE-2023-25156
High
Description
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.
SeverityHigh
CVSS7.5
Exploit probability—
ProductKiwitcms Kiwi Tcms
PublishedFeb 15, 2023
First seenFeb 15, 2023
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- kiwitcms kiwi_tcms12.0 or later
- kiwitcms12.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kiwitcms kiwi_tcms | v < 12.0 | 12.0 |
| kiwitcmsPyPI | v < 12.0 | 12.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.