CVE-2023-30544 json
Kiwi TCMS may allow user to update email address to unverified one
published 2023-04-24 3 y ago modified 2026-09-10 1 mo ago also GHSA-7x6q-3v3m-cwjg , PYSEC-2026-1497 , EUVD-2023-1233
- cvss
- 3.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.
Patch / fix
- pypi kiwitcms 12.2
- kiwitcms kiwi_tcms 12.2
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/1714df73-e639-4d64-ab25-ced82dad9f85 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 0.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N |
| OSV | 3.1 | 0.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | kiwitcms | <12.2 |
12.2 |
Affected products
- kiwitcms Kiwi
Classification
References
-
huntr.com
/bounties/1714df73-e639-4d64-ab25-ced82dad9f85
exploit
-
github.com
/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjg
web, vendor-advisory
-
huntr.dev
/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/
permissions-required
-
kiwitcms.org
/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/
release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-30544
advisory
-
github.com
/kiwitcms/Kiwi
package
-
huntr.dev
/bounties/1714df73-e639-4d64-ab25-ced82dad9f85
web
-
kiwitcms.org
/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122
web
-
pypi.org
/project/kiwitcms
package
-
github.com
/advisories/GHSA-7x6q-3v3m-cwjg
advisory
Sources
- CVE List CVE-2023-30544
- GitHub Advisory GHSA-7x6q-3v3m-cwjg
- NVD CVE-2023-30544
- OSV PYSEC-2026-1497
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.