Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
CVE-2023-36809

8.1HIGH

Key Information:

Vendor

Kiwitcms

Status
Kiwi
Vendor
CVE Published:
5 July 2023

What is CVE-2023-36809?

An issue in Kiwi TCMS, an open-source test management system, allows the upload of potentially harmful scripts via incomplete sanitization of uploaded files. This was exacerbated by incorrect Nginx configurations that allowed certain browsers to bypass security headers, leading to the execution of dangerous files. The vulnerability has been addressed in version 12.5, which includes enhanced file upload validation and improved Nginx content type configuration to mitigate such risks.

Affected Version(s)

Kiwi < 12.5

References

https://github.com/kiwitcms/Kiwi/security/advisories/GHSA...
x_refsource_CONFIRM
https://huntr.dev/bounties/511489dd-ba38-4806-9029-b28ab2...
x_refsource_MISC
https://huntr.dev/bounties/c6eeb346-fa99-4d41-bc40-b68f8d...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.