GitHub Advisoryadvisory · PyPI

GHSA-7968-h4m4-ghm9 No protection against brute-force attacks on login page

HIGH Published 2023-02-15 Modified 2023-02-15 Official page ↗
Aliases
CVE-2023-25156
Ecosystem
PyPI
Packages
kiwitcms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-307
Reviewed
2023-02-15

Affected packages

• PyPI kiwitcms: < 12.0 → fixed in 12.0

Description

Impact Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page. Patches Users should upgrade to v12.0 or later. Workarounds Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx. References Disclosed by spyata

Related

Alias · CVE (1)

  • CVE-2023-25156 Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. vulnerability

Weakness · CWE (1)

  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References