PT-2023-18507 · Kiwi Tcms · Kiwi Tcms

Spyata · Published 2023-01-02 · Updated 2023-01-09 · CVE-2023-22451

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions 11.6 and prior

Description Kiwi TCMS is an open source test management system. In versions prior to 11.7, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the AUTH PASSWORD VALIDATORS configuration setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric.

Recommendations For Kiwi TCMS versions 11.6 and prior, update to version 11.7 or later to resolve the issue. As a temporary workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2023-22451

GHSA-496X-2JQF-HP7G

Affected Products

Kiwi Tcms

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22451.json · Exploit
• https://github.com/kiwitcms/Kiwi/commit/3759fb68aed36315cdde9fc573b2fe7c11544985 · Patch
• https://osv.dev/vulnerability/CVE-2023-22451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22451 · Security Note
• https://huntr.dev/bounties/32a873c8-f605-4aae-9272-d80985ef2b73 · Patch
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-496x-2jqf-hp7g · Note
• https://t.me/cvenotify/41108 · Telegram Post
• https://t.me/cibsecurity/55741 · Telegram Post