Kiwi TCMS has no protection against brute-force attacks on login page

CVE-2023-25156

What is CVE-2023-25156?

Kiwi TCMS, an open-source test management tool, is susceptible to brute-force attacks due to the lack of rate limiting in versions earlier than 12.0. This vulnerability allows attackers to attempt numerous login attempts without restriction, potentially compromising user accounts. To mitigate this security risk, users are advised to upgrade to version 12.0 or later, where a patch has been implemented. As an immediate workaround, configuring a rate-limiting proxy in front of the Kiwi TCMS instance can help defend against such attacks.

References