TI-2023-10618 Aliases CVE-2023-25156 GHSA-7968-h4m4-ghm9

Kiwi TCMS has no protection against brute-force attacks on login page

MEDIUM 50CWE-770Published 2023-02-15 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service, Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-770 and CWE-307.

Summary

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0091 60th percentileScored 2026-11-07

Fix Fixed kiwi (kiwitcms): 12.0kiwitcms (PyPI): 12.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kiwitcms	kiwi	12.0 to before 12.0	12.0	Patch available	CNA
—	kiwitcms (PyPI)	before 12.0	12.0	Patch available	GHSA-7968-h4m4-ghm9

kiwi Vendorkiwitcms Affected 12.0 to before 12.0 Fixed in 12.0 Patch available CNA
kiwitcms (PyPI) Vendor— Affected before 12.0 Fixed in 12.0 Patch available GHSA-7968-h4m4-ghm9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:kiwitcms:kiwi_tcms::::::::	before 12.0	Vulnerable	kiwitcms

cpe:2.3:a:kiwitcms:kiwi_tcms:*:*:*:*:*:*:*:* Versions before 12.0 Vulnerable ·kiwitcms

Remediation

Fix · CNA kiwi (kiwitcms) Fixed in 12.0
Fix · GHSA-7968-h4m4-ghm9 kiwitcms (PyPI) Fixed in 12.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-02-15
kiwitcms kiwi 12.0
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2023-10633 Kiwi TCMS has denial of service vulnerability on Password reset pagePriority MEDIUM 41
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-25156
2026-10-03 Alias added: GHSA-7968-h4m4-ghm9

References

Patch 1

https://github.com/kiwitcms/Kiwi/commit/0ed213fa0ddb7a6dc77e3c3b99e8fc90ccdaf46f

Advisory 2

Other 5

TI-2023-14429 Kiwi TCMS unrestricted file upload vulnerability CVSS 3.1CRITICAL 9.0
TI-2023-14444 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow CVSS 3.1HIGH 8.8
TI-2023-18603 Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox CVSS 3.1HIGH 8.1
TI-2023-16845 Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS CVSS 3.1HIGH 8.1
TI-2022-03753 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi CVSS 3.1MEDIUM 5.4
TI-2023-14379 Kiwi TCMS may allow user to update email address to unverified one CVSS 3.1MEDIUM 4.3

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences