摘要:
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.
安全等级: Low
公告ID: KylinSec-SA-2023-1102
发布日期: 2023年2月27日
关联CVE: CVE-2023-25171
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2023-25171 | KY3.4-4A | kiwi | Unaffected |
| CVE-2023-25171 | KY3.4-5A | kiwi | Unaffected |
| CVE-2023-25171 | KY3.5.1 | kiwi | Unaffected |
| CVE-2023-25171 | KY3.5.2 | kiwi | Unaffected |
