CVE-2023-25171
Assigner: GitHub_M
Published: 2023-02-15T00:00:00
State: PUBLISHED
title: Kiwi TCMS has denial of service vulnerability on Password reset page
descriptions: value: Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.
affected: vendor: kiwitcms
product: kiwi
versions: version: 12.0
status: affected
lessThan: 12.0
versionType: custom
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-770 Allocation of Resources Without Limits or Throttling
cweId: CWE-770
x_generator: engine: Vulnogram 0.0.9
source: advisory: GHSA-7j9h-3jxf-3vrf
defect: GHSA-7j9h-3jxf-3vrf
discovery: UNKNOWN