GitHub Advisoryadvisory · PyPI

GHSA-7x6q-3v3m-cwjg kiwi TCMS has possibility for user to update email address to unverified one

LOW Published 2023-04-24 Modified 2023-04-24 Official page ↗
Aliases
CVE-2023-30544
Ecosystem
PyPI
Packages
kiwitcms
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
Weaknesses
CWE-283, CWE-863
Reviewed
2023-04-24

Affected packages

• PyPI kiwitcms: < 12.2 → fixed in 12.2

Description

Impact In previous versions of Kiwi TCMS users were able to update their email addresses via the "My profile" admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Patches With Kiwi TCMS v12.2 or later it is not possible to edit the email field associated with a user account! Workarounds No workaround exists. References Disclosed by @novemberdad.

Related

Alias · CVE (1)

  • CVE-2023-30544 Kiwi TCMS is an open source test management system. vulnerability

Weakness · CWE (2)

  • CWE-283 Unverified Ownership weakness
  • CWE-863 Incorrect Authorization weakness

References