CVE-2023-25156

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.

Affected products

Kiwi Tcms, Nginx

Kiwitcms Kiwi Tcms

< 12.0

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

0.9% (56th percentile)

Weakness

CWE-770, CWE-307

NVD status

Modified

Published

2023-02-15

No exploit for CVE-2023-25156 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.