CVE-2023-25171

Katalog CVE

CVSS 5.9 · Medium EPSS 0,92%

Kerentanan Allocation of Resources Without Limits or Throttling pada kiwitcms kiwi tcms. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.

Rincian

Terbit di NVD

15 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,92% peluang dieksploitasi; lebih tinggi dari 59,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7j9h-3jxf-3vrf advisory vendor
• https://github.com/kiwitcms/Kiwi/commit/761305d04f5910ba14cc04d1255a8f1afdbb87f3 patch
• https://huntr.dev/bounties/3b712cb6-3fa3-4f71-8562-7a7016c6262e permissions required
• https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120/ release notes