medium6.5
CVE-2023-22451
Kiwi TCMS is an open source test management system.
Impact
Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the `AUTH_PASSWORD_VALIDATORS` configuration setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kiwitcms | Kiwi Tcms | before 11.7 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/kiwitcms/Kiwi/commit/3759fb68aed36315cdde9fc573b2fe7c11544985
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-496x-2jqf-hp7g
- https://huntr.dev/bounties/32a873c8-f605-4aae-9272-d80985ef2b73
- https://github.com/kiwitcms/Kiwi/commit/3759fb68aed36315cdde9fc573b2fe7c11544985
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-496x-2jqf-hp7g
- https://huntr.dev/bounties/32a873c8-f605-4aae-9272-d80985ef2b73