CVE-2023-25156

Katalog CVE

CVSS 9.8 · Critical EPSS 0,91%

Kerentanan Allocation of Resources Without Limits or Throttling pada kiwitcms kiwi tcms. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.

Rincian

Terbit di NVD

15 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling
CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7968-h4m4-ghm9 advisory vendor
• https://github.com/kiwitcms/Kiwi/commit/0ed213fa0ddb7a6dc77e3c3b99e8fc90ccdaf46f patch
• https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795/ permissions required
• https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120/ release notes