Vulnerability · Published Feb 15, 2023 · Assigned by GitHub_M
CVE-2023-25156Kiwi TCMS has no protection against brute-force attacks on login page
High 7.5
In plain English
A high-severity resource allocation without limits in kiwi from kiwitcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | kiwitcms | 12.0 | GHSA-7968-h4m4-ghm9 |
| PyPI | kiwitcms | 12.0 | PYSEC-2026-835 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H