GHSA-7968-h4m4-ghm9

Suggest an improvement
Source
https://github.com/advisories/GHSA-7968-h4m4-ghm9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-7968-h4m4-ghm9/GHSA-7968-h4m4-ghm9.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-7968-h4m4-ghm9
Aliases
Published
2023-02-15T18:10:54Z
Modified
2024-02-18T05:33:15.769760Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
No protection against brute-force attacks on login page
Details

Impact

Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page.

Patches

Users should upgrade to v12.0 or later.

Workarounds

Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx.

References

Disclosed by spyata

Database specific 
{
    "github_reviewed_at": "2023-02-15T18:10:54Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-307"
    ],
    "nvd_published_at": "2023-02-15T15:15:00Z"
}
References

Affected packages

PyPI / kiwitcms

Package

Name
kiwitcms
View open source insights on deps.dev
Purl
pkg:pypi/kiwitcms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
12.0

Affected versions

6.*
6.2.1
6.3
6.4
6.5
6.5.3
6.6
6.7
6.8
6.9
6.10
6.11
7.*
7.0
7.1
7.2
7.2.1
7.3
8.*
8.0
8.1
8.1.99
8.2
8.3
8.4
8.5
8.6
8.6.1
8.7
8.8
8.9
9.*
9.0
9.999
10.*
10.0
10.1
10.2
10.3
10.3.999
10.4
10.5
11.*
11.0
11.1
11.3
11.4
11.5
11.6
11.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-7968-h4m4-ghm9/GHSA-7968-h4m4-ghm9.json"