Read the docs
TI-2022-03753 Aliases CVE-2022-4105GHSA-hf94-8mx5-2vvj

Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi

Priority HIGH 66CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00506 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed kiwitcms/kiwi (kiwitcms): 11.6kiwitcms (PyPI): 11.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kiwitcmskiwitcms/kiwibefore 11.611.6Patch availableCNA
—kiwitcms (PyPI)before 11.611.6Patch availableGHSA-hf94-8mx5-2vvj
  • kiwitcms/kiwi Vendorkiwitcms Affected before 11.6 Fixed in 11.6 Patch available CNA
  • kiwitcms (PyPI) Vendor— Affected before 11.6 Fixed in 11.6 Patch available GHSA-hf94-8mx5-2vvj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kiwitcms:kiwi_tcms:*:*:*:*:*:*:*:*before 11.6Vulnerablekiwitcms
  • cpe:2.3:a:kiwitcms:kiwi_tcms:*:*:*:*:*:*:*:* Versions before 11.6 Vulnerable ·kiwitcms

Remediation

  • Fix · CNA kiwitcms/kiwi (kiwitcms) Fixed in 11.6
  • Fix · GHSA-hf94-8mx5-2vvj kiwitcms (PyPI) Fixed in 11.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-4105
  2. 2026-10-03 Alias added: GHSA-hf94-8mx5-2vvj

References

Exploit 1

Patch 1

Advisory 1

  • TI-2023-14429 Kiwi TCMS unrestricted file upload vulnerability CVSS 3.1CRITICAL 9.0
  • TI-2023-14444 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow CVSS 3.1HIGH 8.8
  • TI-2023-18603 Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox CVSS 3.1HIGH 8.1
  • TI-2023-16845 Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS CVSS 3.1HIGH 8.1
  • TI-2023-14379 Kiwi TCMS may allow user to update email address to unverified one CVSS 3.1MEDIUM 4.3
  • TI-2023-10618 Kiwi TCMS has no protection against brute-force attacks on login page CVSS 3.1CRITICAL 9.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences