Vulnerability · Published May 27, 2023 · Assigned by GitHub_M
CVE-2023-32686kiwitcms vulnerable to stored XSS via unrestricted files upload
High 8.1
In plain English
A high-severity cross-site scripting in Kiwi from kiwitcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded. The upload validation checks were not robust enough which left the possibility of an attacker to circumvent them and upload a potentially dangerous file. Exploiting this flaw, a combination of files could be uploaded so that they work together to circumvent the existing Content-Security-Policy and allow execution of arbitrary JavaScript in the browser. This issue has been patched in version 12.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | kiwitcms | 12.3 | GHSA-x7c2-7wvg-jpx7 |
| PyPI | kiwitcms | 12.3 | PYSEC-2026-1500 |
Affected products (as reported)
Weakness: CWE-79, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-x7c2-7wvg-jpx7 x_refsource_CONFIRM
- https://kiwitcms.org/blog/kiwi-tcms-team/2023/05/22/kiwi-tcms-123/ x_refsource_MISC