Back to Database
Status published
High
CVE-2023-25156
Kiwi TCMS has no protection against brute-force attacks on login page
Vulnerability Description
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-25156
Credits & Attribution
No credits recorded in the NVD database.
References
More from kiwitcms
View All →CVE-2023-36809
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
High
8.1
CVE-2023-33977
Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS
High
8.1
CVE-2023-32686
kiwitcms vulnerable to stored XSS via unrestricted files upload
High
8.1
CVE-2023-30628
Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow
High
8.8
CVE-2023-30613
Kiwi TCMS unrestricted file upload vulnerability
High
8.1
Affected Vendor
kiwitcms
View all reports →Affected Software
kiwi
Vulnerable Versions:
12.0
Timeline
Official Publish:
February 15th, 2023
Last Modified:
March 10th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H