CVE-2023-22451

Katalog CVE

CVSS 8.8 · High EPSS 0,71%

Kerentanan Weak Password Requirements pada kiwitcms kiwi tcms. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the `AUTH_PASSWORD_VALIDATORS` configuration setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen.

Rincian

Terbit di NVD

2 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-521: Weak Password Requirements

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kiwitcms/Kiwi/commit/3759fb68aed36315cdde9fc573b2fe7c11544985 patch · advisory pihak ketiga
• https://huntr.dev/bounties/32a873c8-f605-4aae-9272-d80985ef2b73 patch · advisory pihak ketiga
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-496x-2jqf-hp7g mitigasi · advisory pihak ketiga