kiwitcms vulnerable to stored XSS via unrestricted files upload
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution, Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434 and CWE-79.
Summary
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded. The upload validation checks were not robust enough which left the possibility of an attacker to circumvent them and upload a potentially dangerous file. Exploiting this flaw, a combination of files could be uploaded so that they work together to circumvent the existing Content-Security-Policy and allow execution of arbitrary JavaScript in the browser. This issue has been patched in version 12.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kiwitcms | Kiwi | before 12.3 | 12.3 | Patch available | CNA |
| — | kiwitcms (PyPI) | before 12.3 | 12.3 | Patch available | GHSA-x7c2-7wvg-jpx7 |
- Kiwi Vendorkiwitcms Affected before 12.3 Fixed in 12.3 Patch available CNA
- kiwitcms (PyPI) Vendor— Affected before 12.3 Fixed in 12.3 Patch available GHSA-x7c2-7wvg-jpx7
Remediation
- Fix · CNA Kiwi (kiwitcms) Fixed in 12.3
- Fix · GHSA-x7c2-7wvg-jpx7 kiwitcms (PyPI) Fixed in 12.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-32686
- 2026-10-03 Alias added: GHSA-x7c2-7wvg-jpx7
References
Advisory 2
Other 5
- https://kiwitcms.org/blog/kiwi-tcms-team/2023/05/22/kiwi-tcms-123/
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj
- https://github.com/kiwitcms/Kiwi
- https://kiwitcms.org/blog/kiwi-tcms-team/2023/05/22/kiwi-tcms-123
More kiwitcms Kiwi Tcms vulnerabilities
- TI-2023-14429 Kiwi TCMS unrestricted file upload vulnerability CVSS 3.1CRITICAL 9.0
- TI-2023-14444 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow CVSS 3.1HIGH 8.8
- TI-2023-18603 Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox CVSS 3.1HIGH 8.1
- TI-2023-16845 Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS CVSS 3.1HIGH 8.1
- TI-2022-03753 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi CVSS 3.1MEDIUM 5.4
- TI-2023-14379 Kiwi TCMS may allow user to update email address to unverified one CVSS 3.1MEDIUM 4.3
Sources
- CVE-2023-32686 · CVE Program
- CVE-2023-32686 · NVD
- FIRST EPSS
- GHSA-x7c2-7wvg-jpx7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences