Description
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kiwitcms | kiwi | 12.0 – < 12.0 | 12.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | kiwitcms | < 12.0 | 12.0 | GHSA-7968-h4m4-ghm9 |