CVE-2023-25156 Kiwi TCMS has no protection against brute-force attacks on login page
Attackers can brute-force login credentials due to missing rate limits, potentially taking over accounts in Kiwi TCMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-25156?
CVE-2023-25156 is a high-severity vulnerability in kiwitcms kiwi, published on 15 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.
Which versions are affected by CVE-2023-25156?
3 open source packages ship an affected version, including kiwitcms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kiwitcms PyPI | All versions | 12.0 |
kiwitcms PyPI | All versions | 12.0 |
kiwitcms PyPI | All versions | 12.0 |
Products include Kiwitcms Kiwi Tcms.
How do I fix CVE-2023-25156?
Upgrade kiwitcms to 12.0 or later.
Is CVE-2023-25156 being exploited?
There is no known exploitation of CVE-2023-25156 in the wild and no public exploit code.
Other vulnerabilities in kiwitcms kiwi
- CVE-2023-30628 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow
- CVE-2023-36809 Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
- CVE-2023-33977 Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS
- CVE-2023-32686 kiwitcms vulnerable to stored XSS via unrestricted files upload
- CVE-2023-30613 Kiwi TCMS unrestricted file upload vulnerability
Sources
Also known as GHSA-7968-h4m4-ghm9, PYSEC-2026-835.