Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hkzu-pudk-y7g9
Vulnerability ID VCID-hkzu-pudk-y7g9
Aliases CVE-2023-25171
GHSA-7j9h-3jxf-3vrf
Summary Denial of service vulnerability on Password reset page Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-770 Allocation of Resources Without Limits or Throttling
System Score Found at
epss 0.00772 https://api.first.org/data/v1/epss?cve=CVE-2023-25171
epss 0.00772 https://api.first.org/data/v1/epss?cve=CVE-2023-25171
epss 0.00772 https://api.first.org/data/v1/epss?cve=CVE-2023-25171
epss 0.00772 https://api.first.org/data/v1/epss?cve=CVE-2023-25171
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-7j9h-3jxf-3vrf
cvssv3.1 7.5 https://github.com/kiwitcms/Kiwi
generic_textual HIGH https://github.com/kiwitcms/Kiwi
cvssv3.1 7.5 https://github.com/kiwitcms/Kiwi/commit/761305d04f5910ba14cc04d1255a8f1afdbb87f3
generic_textual HIGH https://github.com/kiwitcms/Kiwi/commit/761305d04f5910ba14cc04d1255a8f1afdbb87f3
ssvc Track https://github.com/kiwitcms/Kiwi/commit/761305d04f5910ba14cc04d1255a8f1afdbb87f3
cvssv3.1 7.5 https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7j9h-3jxf-3vrf
cvssv3.1_qr HIGH https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7j9h-3jxf-3vrf
generic_textual HIGH https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7j9h-3jxf-3vrf
ssvc Track https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7j9h-3jxf-3vrf
cvssv3.1 7.5 https://huntr.dev/bounties/3b712cb6-3fa3-4f71-8562-7a7016c6262e
generic_textual HIGH https://huntr.dev/bounties/3b712cb6-3fa3-4f71-8562-7a7016c6262e
ssvc Track https://huntr.dev/bounties/3b712cb6-3fa3-4f71-8562-7a7016c6262e
cvssv3.1 7.5 https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120
generic_textual HIGH https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120
cvssv3.1 7.5 https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120/
ssvc Track https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120/
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-25171
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-25171
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-25171
https://github.com/kiwitcms/Kiwi
https://github.com/kiwitcms/Kiwi/commit/761305d04f5910ba14cc04d1255a8f1afdbb87f3
https://huntr.dev/bounties/3b712cb6-3fa3-4f71-8562-7a7016c6262e
https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120
https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120/
CVE-2023-25171 https://nvd.nist.gov/vuln/detail/CVE-2023-25171
GHSA-7j9h-3jxf-3vrf https://github.com/advisories/GHSA-7j9h-3jxf-3vrf
GHSA-7j9h-3jxf-3vrf https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7j9h-3jxf-3vrf
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/kiwitcms/Kiwi
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/kiwitcms/Kiwi/commit/761305d04f5910ba14cc04d1255a8f1afdbb87f3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-10T20:58:32Z/ Found at https://github.com/kiwitcms/Kiwi/commit/761305d04f5910ba14cc04d1255a8f1afdbb87f3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7j9h-3jxf-3vrf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-10T20:58:32Z/ Found at https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7j9h-3jxf-3vrf
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://huntr.dev/bounties/3b712cb6-3fa3-4f71-8562-7a7016c6262e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-10T20:58:32Z/ Found at https://huntr.dev/bounties/3b712cb6-3fa3-4f71-8562-7a7016c6262e
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-10T20:58:32Z/ Found at https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-25171
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.73926
EPSS Score 0.00772
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:44:02.080723+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/kiwitcms/CVE-2023-25171.yml 38.6.0