PT-2023-22810 · Kiwi Tcms · Kiwi Tcms

Mosaa404

·

Published

2023-04-24

·

Updated

2023-05-03

·

CVE-2023-30613

CVSS v3.1

8.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.2
Description The issue allows users to upload attachments to test plans, test cases, etc., without control over the types of files that can be uploaded. A malicious actor may upload an .exe file or a file containing embedded JavaScript, potentially tricking others into clicking on these files and causing vulnerable browsers to execute malicious code on another computer. This could lead to cross-site scripting (XSS) attacks. Kiwi TCMS version 12.2 introduces functionality for administrators to configure additional upload validator functions, giving them more control over accepted file types. By default, .exe files are denied, as are files containing the <script> tag, due to their potential for XSS attacks.
Recommendations Upgrade to Kiwi TCMS version 12.2 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to trusted users or disabling the file upload feature until the upgrade is possible. Administrators can also configure additional upload validator functions to deny specific file types, such as .exe files or files containing the <script> tag.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-30613
GHSA-FWCF-753V-FGCJ

Affected Products

Kiwi Tcms