Kiwi TCMS may allow user to update email address to unverified one
CVE-2023-30544

4.3MEDIUM

Key Information:

Vendor

Kiwitcms

Status
Kiwi
Vendor
CVE Published:
24 April 2023

What is CVE-2023-30544?

Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the My profile admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.

Affected Version(s)

Kiwi < 12.2

References

https://github.com/kiwitcms/Kiwi/security/advisories/GHSA...
x_refsource_CONFIRM
https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82d...
x_refsource_MISC
https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.