No protection against brute-force attacks on login page
### Impact Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page. ### Patches Users should upgrade to v12.0 or later. ### Workarounds Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx. ### References [Disclosed by spyata](https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795/)
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-25156US | critical9.8 | — | ||
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page.… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/advisories/GHSA-7968-h4m4-ghm9ADVISORY
- https://github.com/kiwitcms/KiwiPACKAGE
- https://github.com/kiwitcms/Kiwi/commit/0ed213fa0ddb7a6dc77e3c3b99e8fc90ccdaf46fWEB
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7968-h4m4-ghm9WEB
- https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795WEB
- https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120WEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-25156ADVISORY
- https://pypi.org/project/kiwitcmsPACKAGE
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan