CVE-2023-30544

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-30544
Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.

4.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjg Vendor Advisory
https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjg Vendor Advisory
https://huntr.com/bounties/1714df73-e639-4d64-ab25-ced82dad9f85
https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/ Permissions Required
https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/ Permissions Required
https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/ Release Notes
https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/ Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:kiwitcms:kiwi_tcms:*:*:*:*:*:*:*:*
History

04 Feb 2025, 19:15

Type Values Removed Values Added
References
  • () https://huntr.com/bounties/1714df73-e639-4d64-ab25-ced82dad9f85 -
References (MISC) https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/ - Release Notes () https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/ - Release Notes
References (MISC) https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/ - Permissions Required () https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/ - Permissions Required
References (MISC) https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjg - Vendor Advisory () https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjg - Vendor Advisory

03 May 2023, 18:52

Type Values Removed Values Added
CPE cpe:2.3:a:kiwitcms:kiwi_tcms:*:*:*:*:*:*:*:*
First Time Kiwitcms
Kiwitcms kiwi Tcms
CWE CWE-283
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3
References (MISC) https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/ - (MISC) https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/ - Permissions Required
References (MISC) https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjg - (MISC) https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjg - Vendor Advisory
References (MISC) https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/ - (MISC) https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/ - Release Notes

24 Apr 2023, 17:43

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-24 17:15

Updated : 2025-02-04 19:15

NVD link : CVE-2023-30544

Mitre link : CVE-2023-30544

JSON object : View

Products Affected

kiwitcms

  • kiwi_tcms
CWE
CWE-863

Incorrect Authorization