Vulnerability in Kiwitcms Kiwi
CVE-2023-22451
Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the `AUTH_PASSWORD_VALIDATORS` configuration setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.007 (50.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Kiwitcms Kiwi — versions <= 11.6
- Kiwitcms Kiwi Tcms
Weakness classification (CWE)
References
- github.com/kiwitcms/Kiwi/security/advisories/GHSA-496x-2jqf-hp7g (Third Party Advisory, Mitigation)
- github.com/kiwitcms/Kiwi/commit/3759fb68aed36315cdde9fc573b2fe7c11544985 (Patch, Third Party Advisory)
- huntr.dev/bounties/32a873c8-f605-4aae-9272-d80985ef2b73 (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-22451?
- CVE-2023-22451 is a medium-severity vulnerability in Kiwitcms Kiwi, classified under Weak Password Requirements. CVSS score: 6.5/10. Published 2023-01-02.
- How severe is CVE-2023-22451?
- Medium severity. CVSS v3 base score is 6.5 out of 10.