CVE-2023-22451
highpriority · track · 35EPSS 0.007 · 53 %ileEUUSEPSS · scored 2026-10-28
Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the `AUTH_PASSWORD_VALIDATORS` configuration setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-22451/cnnvd
- https://github.com/kiwitcms/Kiwi/Patchcnnvd
- https://github.com/kiwitcms/Kiwi/commit/3759fb68aed36315cdde9fc573b2fe7c11544985cnnvd
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-496x-2jqf-hp7gcnnvd
- https://huntr.dev/bounties/32a873c8-f605-4aae-9272-d80985ef2b73cnnvd
- https://github.com/kiwitcms/Kiwi/commit/3759fb68aed36315cdde9fc573b2fe7c11544985enisa_euvd
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-496x-2jqf-hp7genisa_euvd
- https://huntr.dev/bounties/32a873c8-f605-4aae-9272-d80985ef2b73enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan