PT-2023-22771 · Kiwi Tcms · Kiwi Tcms

Novemberdad · Published 2023-04-24 · Updated 2023-05-03 · CVE-2023-30544

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.2

Description Kiwi TCMS is an open source test management system. In versions prior to 12.2, users were able to update their email addresses via the My profile admin page without the ownership verification performed during account registration.

Recommendations For Kiwi TCMS versions prior to 12.2, upgrade to v12.2 or later to receive a patch. As a temporary workaround, consider restricting access to the My profile admin page until a patch is available. No other workarounds exist.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-283

CWE-863

Related Identifiers

CVE-2023-30544

GHSA-7X6Q-3V3M-CWJG

Affected Products

Kiwi Tcms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30544.json · Exploit
• 🔥 https://huntr.com/bounties/1714df73-e639-4d64-ab25-ced82dad9f85 · Exploit
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30544 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30544 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7x6q-3v3m-cwjg · Vendor Advisory
• https://github.com/kiwitcms/Kiwi · Note
• https://t.me/cibsecurity/62736 · Telegram Post
• https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85 · Note
• https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122 · Note
• https://t.me/cvenotify/49743 · Telegram Post