摘要:
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.
安全等级: Low
公告ID: KylinSec-SA-2023-1103
发布日期: 2023年2月27日
关联CVE: CVE-2023-25156
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2023-25156 | KY3.4-4A | kiwi | Unaffected |
| CVE-2023-25156 | KY3.4-5A | kiwi | Unaffected |
| CVE-2023-25156 | KY3.5.1 | kiwi | Unaffected |
| CVE-2023-25156 | KY3.5.2 | kiwi | Unaffected |
