TI-2023-10633 Aliases CVE-2023-25171 GHSA-7j9h-3jxf-3vrf

Kiwi TCMS has denial of service vulnerability on Password reset page

MEDIUM 41CWE-770Published 2023-02-15 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00916 60th percentileScored 2026-11-07

Fix Fixed kiwi (kiwitcms): 12.0kiwitcms (PyPI): 12.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kiwitcms	kiwi	12.0 to before 12.0	12.0	Patch available	CNA
—	kiwitcms (PyPI)	before 12.0	12.0	Patch available	GHSA-7j9h-3jxf-3vrf

kiwi Vendorkiwitcms Affected 12.0 to before 12.0 Fixed in 12.0 Patch available CNA
kiwitcms (PyPI) Vendor— Affected before 12.0 Fixed in 12.0 Patch available GHSA-7j9h-3jxf-3vrf

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:kiwitcms:kiwi_tcms::::::::	before 12.0	Vulnerable	kiwitcms

cpe:2.3:a:kiwitcms:kiwi_tcms:*:*:*:*:*:*:*:* Versions before 12.0 Vulnerable ·kiwitcms

Remediation

Fix · CNA kiwi (kiwitcms) Fixed in 12.0
Fix · GHSA-7j9h-3jxf-3vrf kiwitcms (PyPI) Fixed in 12.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-02-15
kiwitcms kiwi 12.0
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2023-10618 Kiwi TCMS has no protection against brute-force attacks on login pagePriority MEDIUM 50
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-25171
2026-10-03 Alias added: GHSA-7j9h-3jxf-3vrf

References

Patch 1

https://github.com/kiwitcms/Kiwi/commit/761305d04f5910ba14cc04d1255a8f1afdbb87f3

Advisory 2

Other 4

TI-2023-14429 Kiwi TCMS unrestricted file upload vulnerability CVSS 3.1CRITICAL 9.0
TI-2023-14444 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow CVSS 3.1HIGH 8.8
TI-2023-18603 Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox CVSS 3.1HIGH 8.1
TI-2023-16845 Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS CVSS 3.1HIGH 8.1
TI-2022-03753 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi CVSS 3.1MEDIUM 5.4
TI-2023-14379 Kiwi TCMS may allow user to update email address to unverified one CVSS 3.1MEDIUM 4.3

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences