Описание
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.
Ссылки
- Patch
- Vendor Advisory
- Permissions Required
- Release Notes
- Patch
- Vendor Advisory
- Permissions Required
- Release Notes
Уязвимые конфигурации
Конфигурация 1Версия до 12.0 (исключая)
cpe:2.3:a:kiwitcms:kiwi_tcms:*:*:*:*:*:*:*:*
EPSS
Процентиль: 52%
0.00289
Низкий
7.5 High
CVSS3
9.8 Critical
CVSS3
Дефекты
CWE-770
CWE-307
Связанные уязвимости
CVSS3: 7.5
github
почти 3 года назад
No protection against brute-force attacks on login page
EPSS
Процентиль: 52%
0.00289
Низкий
7.5 High
CVSS3
9.8 Critical
CVSS3
Дефекты
CWE-770
CWE-307