PT-2023-22771 · Kiwi Tcms · Kiwi Tcms

Novemberdad · Publicado 2023-04-24 · Atualizado 2023-05-03 · CVE-2023-30544

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.2

Description Kiwi TCMS is an open source test management system. In versions prior to 12.2, users were able to update their email addresses via the My profile admin page without the ownership verification performed during account registration.

Recommendations For Kiwi TCMS versions prior to 12.2, upgrade to v12.2 or later to receive a patch. As a temporary workaround, consider restricting access to the My profile admin page until a patch is available. No other workarounds exist.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-283

CWE-863

Identificadores relacionados

CVE-2023-30544

GHSA-7X6Q-3V3M-CWJG

Produtos afetados

Kiwi Tcms

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30544.json · Exploit
• 🔥 https://huntr.com/bounties/1714df73-e639-4d64-ab25-ced82dad9f85 · Exploit
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjg · Aviso do Fabricante
• https://github.com/kiwitcms/Kiwi · Nota
• https://t.me/cibsecurity/62736 · Publicação no Telegram
• https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-30544 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-30544 · Aviso do Fabricante
• https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122 · Nota
• https://t.me/cvenotify/49743 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-7x6q-3v3m-cwjg · Aviso do Fabricante