Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.
Metrics
Affected Vendors & Products
References
History
No history.

Status: PUBLISHED
Assigner: GitHub_M
Published: 2023-02-15T00:00:00
Updated: 2024-08-02T11:18:36.151Z
Reserved: 2023-02-03T00:00:00
Link: CVE-2023-25171

No data.

Status : Modified
Published: 2023-02-15T15:15:11.653
Modified: 2024-11-21T07:49:14.837
Link: CVE-2023-25171

No data.