Detections
Analytics
SCA: security update for kiwitcms (GHSA-jpgw-2r9m-8qfw)
medium Tenable Self-Hosted Container Security Plugin ID 416493
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test
cases, etc. Versions of Kiwi TCMS prior to 12.5 had introduced changes which were meant to serve all
uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when
such files are accessed directly. The previous Nginx configuration was incorrect allowing certain browsers
like Firefox to ignore the `Content-Type: text/plain` header on some occasions thus allowing potentially
dangerous scripts to be executed. Additionally, file upload validators and parts of the HTML rendering
code had been found to require additional sanitation and improvements. Version 12.5 fixes this
vulnerability with updated Nginx content type configuration, improved file upload validation code to
prevent more potentially dangerous uploads, and Sanitization of test plan names used in the
`tree_view_html()` function. (CVE-2023-36809)
See Also
Plugin Details
Severity: Medium
ID: 416493
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 9.14
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N
CVSS Score Source: CVE-2023-36809
CVSS v3
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/5/2023
Vulnerability Publication Date: 7/5/2023
Reference Information
CVE: CVE-2023-36809