CVE-2023-30544

LOW

Kiwi TCMS may allow user to update email address to unverified one

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-30544 has a selected CVSS score of 3.9 (low).

Description

Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 4, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Kiwi

Browse kiwitcms / Kiwi
CVE List< 12.2affected

kiwitcms

Browse PyPI / kiwitcms
GitHub AdvisoryBefore 12.2 · Fixed in 12.2affected

References

6