Log in Start free

Vulnerability · Published Jul 5, 2023 · Assigned by GitHub_M

CVE-2023-36809Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox

High 8.1

In plain English

A high-severity cross-site scripting in Kiwi from kiwitcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.7%top 46.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc. Versions of Kiwi TCMS prior to 12.5 had introduced changes which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed directly. The previous Nginx configuration was incorrect allowing certain browsers like Firefox to ignore the `Content-Type: text/plain` header on some occasions thus allowing potentially dangerous scripts to be executed. Additionally, file upload validators and parts of the HTML rendering code had been found to require additional sanitation and improvements. Version 12.5 fixes this vulnerability with updated Nginx content type configuration, improved file upload validation code to prevent more potentially dangerous uploads, and Sanitization of test plan names used in the `tree_view_html()` function.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIkiwitcms12.5GHSA-jpgw-2r9m-8qfw
PyPIkiwitcms12.5PYSEC-2026-1499

Affected products (as reported)

VendorProductVersions
kiwitcms Kiwi < 12.5

Weakness: CWE-79, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References