CVE-2023-30544
Low
Description
Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.
SeverityLow
CVSS3.9
Exploit probability—
ProductKiwitcms Kiwi Tcms
PublishedApr 24, 2023
First seenApr 24, 2023
Weakness typeCWE-283CWE-283CWE-863Incorrect authorization
How to fix
Update
- kiwitcms kiwi_tcms12.2 or later
- kiwitcms12.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kiwitcms kiwi_tcms | v < 12.2 | 12.2 |
| kiwitcmsPyPI | v < 12.2 | 12.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.