Arbitrary File Upload Affecting kiwitcms package, versions [,12.2)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.19% (58th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-KIWITCMS-5458976
- published 25 Apr 2023
- disclosed 24 Apr 2023
- credit Ahmed Rabeaa Mosaa
Introduced: 24 Apr 2023
CVE-2023-30613 Open this link in a new tabHow to fix?
Upgrade kiwitcms to version 12.2 or higher.
Overview
kiwitcms is a Test Case Management System
Affected versions of this package are vulnerable to Arbitrary File Upload such that a malicious actor may upload an .exe file or a file containing embedded JavaScript and trick others into clicking on these files causing vulnerable browsers to execute malicious code on another computer or attempting XSS attacks.
References
CVSS Scores
version 3.1