CVE-2023-33977
mediumpriority · track · 32EPSS 0.009 · 59 %ileexploit · PoCEURUUSEPSS · scored 2026-10-27
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. The upload validation checks were not 100% robust which left the possibility to circumvent them and upload a potentially dangerous file which allows execution of arbitrary JavaScript in the browser. Additionally we've discovered that Nginx's `proxy_pass` directive will strip some headers negating protections built into Kiwi TCMS when served behind a reverse proxy. This issue has been addressed in version 12.4. Users are advised to upgrade. Users unable to upgrade who are serving Kiwi TCMS behind a reverse proxy should make sure that additional header values are still passed to the client browser. If they aren't redefining them inside the proxy configuration.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.1–8.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- mnqazi/CVE-2023-33977Read more at MediumPoC · poc_in_github
affected products (4)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-2fqm-m4r2-fh98kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload2023-06-06ghsa · osvUS
### Impact Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. The upload validation checks were not 100% robust which left the possibility to circumvent them and upload a potentially dangerous file which allows execution of arbitrary JavaScript in the browser. Additionally we've discovered that Nginx's `proxy_pass` directive will strip some headers negating protections built into Kiwi TCMS when served behind a reverse proxy. ### Patches - Improved file upload validation code - Updated Nginx reverse proxy configuration for ***.tenant.kiwitcms.org** ### Workarounds If serving Kiwi TCMS behind a reverse proxy make sure that additional header values are still passed to the client browser. If they aren't redefine them inside the proxy configuration. See [etc/nginx.conf#L66-L68](https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L66-L68) and [etc/nginx.conf#L87](https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L87) ### References Disclosed by [M Nadeem Qazi](https://huntr.dev/bounties/6aea9a26-e29a-467b-aa5a-f767f0c2ec96/).
- PYSEC-2026-1495kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload2026-07-07vendor · osvUS
### Impact Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. The upload validation checks were not 100% robust which left the possibility to circumvent them and upload a potentially dangerous file which allows execution of arbitrary JavaScript in the browser. Additionally we've discovered that Nginx's `proxy_pass` directive will strip some headers negating protections built into Kiwi TCMS when served behind a reverse proxy. ### Patches - Improved file upload validation code - Updated Nginx reverse proxy configuration for ***.tenant.kiwitcms.org** ### Workarounds If serving Kiwi TCMS behind a reverse proxy make sure that additional header values are still passed to the client browser. If they aren't redefine them inside the proxy configuration. See [etc/nginx.conf#L66-L68](https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L66-L68) and [etc/nginx.conf#L87](https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L87) ### References Disclosed by [M Nadeem Qazi](https://huntr.dev/bounties/6aea9a26-e29a-467b-aa5a-f767f0c2ec96/).
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (16)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-33977/cnnvd
- https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L66-L68cnnvd
- https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L87cnnvd
- https://github.com/kiwitcms/Kiwi/commit/d789f4b51025de4f8c747c037d02e1b0da80b034cnnvd
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2fqm-m4r2-fh98cnnvd
- https://huntr.dev/bounties/6aea9a26-e29a-467b-aa5a-f767f0c2ec96/cnnvd
- https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L66-L68enisa_euvd
- https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L87enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan