CVE-2023-25171: Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service…

PriorityP429medium5.9CVSS 3.1

AVNACHPRNUINSUCNINAH

EPSS

0.91%

55.4th percentile

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
kiwitcms	kiwi	>= 12.0 < 12.0	12.0
kiwitcms	kiwi_tcms	< 12.0	12.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.