PT-2023-19943 · Nginx+1 · Nginx+1

Spyata · Publicado 2023-02-15 · Atualizado 2023-02-24 · CVE-2023-25156

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.0

Description The issue concerns the lack of rate limits in Kiwi TCMS, making it easier for attackers to attempt brute-force attacks against the login page.

Recommendations For versions prior to 12.0, upgrade to v12.0 or later to receive a patch. As a temporary workaround, consider installing and configuring a rate-limiting proxy, such as nginx, in front of Kiwi TCMS.

Exploit

Correção

Improper Restriction of Excessive Authentication Attempts

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-307

CWE-770

Identificadores relacionados

CVE-2023-25156

GHSA-7968-H4M4-GHM9

Produtos afetados

Kiwi Tcms

Nginx

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25156.json · Exploit
• https://github.com/kiwitcms/Kiwi · Nota
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7968-h4m4-ghm9 · Aviso do Fabricante
• https://github.com/kiwitcms/Kiwi/commit/0ed213fa0ddb7a6dc77e3c3b99e8fc90ccdaf46f · Correção
• https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795 · Nota
• https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120 · Nota
• https://osv.dev/vulnerability/GHSA-7968-h4m4-ghm9 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25156 · Nota de Segurança
• https://t.me/cibsecurity/58241 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25156 · Aviso do Fabricante