Patchfirst
Patchfirst
Chainkiwitcms · KiwiPyPI:kiwitcms

kiwitcms Kiwi: successive fixes (2023)

6 CVEs over 4 generations, 15 Feb 2023 to 5 Jul 2023.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2023-2515615 Feb 2023 First in the chain
  2. CVE-2023-2748929 Mar 2023 related to CVE-2023-25156
  3. CVE-2023-3061324 Apr 2023 next fix after CVE-2023-27489
  4. CVE-2023-3268627 May 2023 related to CVE-2023-27489related to CVE-2023-30613
  5. CVE-2023-339776 Jun 2023 next fix after CVE-2023-32686
  6. CVE-2023-368095 Jul 2023 related to CVE-2023-25156related to CVE-2023-27489and 1 more
Feb 2023AprMayJunJul CVE-2023-25156 → CVE-2023-27489: related (high confidence)CVE-2023-27489 → CVE-2023-32686: related (high confidence)CVE-2023-30613 → CVE-2023-32686: related (high confidence)CVE-2023-25156 → CVE-2023-36809: related (medium confidence)CVE-2023-27489 → CVE-2023-36809: related (medium confidence)CVE-2023-32686 → CVE-2023-33977: Next fix in the same package (medium confidence)CVE-2023-33977 → CVE-2023-36809: Next fix in the same package (medium confidence)CVE-2023-27489 → CVE-2023-30613: Next fix in the same package (low confidence) CVE-2023-25156 15 Feb 2023 CVE-2023-27489 29 Mar 2023 CVE-2023-30613 24 Apr 2023 CVE-2023-32686 27 May 2023 CVE-2023-33977 6 Jun 2023 CVE-2023-36809 5 Jul 2023 Feb 2023MarAprMayJunJul CVE-2023-25156 → CVE-2023-27489: related (high confidence)CVE-2023-27489 → CVE-2023-32686: related (high confidence)CVE-2023-30613 → CVE-2023-32686: related (high confidence)CVE-2023-25156 → CVE-2023-36809: related (medium confidence)CVE-2023-27489 → CVE-2023-36809: related (medium confidence)CVE-2023-32686 → CVE-2023-33977: Next fix in the same package (medium confidence)CVE-2023-33977 → CVE-2023-36809: Next fix in the same package (medium confidence)CVE-2023-27489 → CVE-2023-30613: Next fix in the same package (low confidence) CVE-2023-25156 15 Feb 2023 CVE-2023-27489 29 Mar 2023 CVE-2023-30613 24 Apr 2023 CVE-2023-32686 27 May 2023 CVE-2023-33977 6 Jun 2023 CVE-2023-36809 5 Jul 2023
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2023-25156 15 Feb 2023 Kiwi TCMS has no protection against brute-force attacks on login page · fixed in 12.0 First in chain 17.2
CVE-2023-27489 29 Mar 2023 Stored cross site scripting via SVG file upload in Kiwi TCMS · fixed in 12.1 CVE-2023-25156 · related · High 13.7
CVE-2023-30613 24 Apr 2023 Kiwi TCMS unrestricted file upload vulnerability · fixed in 12.2 CVE-2023-27489 · Next fix in the same package · Low 23.4
CVE-2023-32686 27 May 2023 kiwitcms vulnerable to stored XSS via unrestricted files upload · fixed in 12.3 CVE-2023-27489 · related · High 13.1
CVE-2023-33977 6 Jun 2023 Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS · fixed in 12.4 CVE-2023-32686 · Next fix in the same package · Medium 22.4
CVE-2023-36809 5 Jul 2023 Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox · fixed in 12.5 CVE-2023-25156 · related · Medium 16.2
↑ ↓ chooseEnter openEsc close