8.8 - CVE-2023-22451

Executive Summary

Informations
Name	CVE-2023-22451	First vendor Publication	2023-01-02
Vendor	Cve	Last vendor Modification	2023-01-09

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Overall CVSS Score	8.8
Base Score	8.8	Environmental Score	8.8
impact SubScore	5.9	Temporal Score	8.8
Exploitabality Sub Score	2.8

Attack Vector	Network	Attack Complexity	Low
Privileges Required	None	User Interaction	Required
Scope	Unchanged	Confidentiality Impact	High
Integrity Impact	High	Availability Impact	High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	N/A	Attack Range	N/A
Cvss Impact Score	N/A	Attack Complexity	N/A
Cvss Expoit Score	N/A	Authentication	N/A
Calculate full CVSS 2.0 Vectors scores

Detail

Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the `AUTH_PASSWORD_VALIDATORS` configuration setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22451

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-521	Weak Password Requirements

CPE : Common Platform Enumeration

Type	Description	Count
Application	Kiwitcms Kiwi Tcms cpe:2.3:a:kiwitcms:kiwi_tcms::::::::	1

Sources (Detail)

Source	Url
MISC	https://github.com/kiwitcms/Kiwi/commit/3759fb68aed36315cdde9fc573b2fe7c11544985 https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-496x-2jqf-hp7g https://huntr.dev/bounties/32a873c8-f605-4aae-9272-d80985ef2b73