Detections
Analytics

SCA: security update for kiwitcms (GHSA-x7c2-7wvg-jpx7)

medium Tenable Cloud Security Plugin ID 420350

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows
 users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced
 upload validators in order to prevent potentially dangerous files from being uploaded. The upload
 validation checks were not robust enough which left the possibility of an attacker to circumvent them and
 upload a potentially dangerous file. Exploiting this flaw, a combination of files could be uploaded so
 that they work together to circumvent the existing Content-Security-Policy and allow execution of
 arbitrary JavaScript in the browser. This issue has been patched in version 12.3. (CVE-2023-32686)

See Also

https://github.com/advisories/GHSA-x7c2-7wvg-jpx7

Plugin Details

Severity: Medium

ID: 420350

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2023-32686

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/22/2023

Vulnerability Publication Date: 5/22/2023

Reference Information

CVE: CVE-2023-32686