CVE-2023-33977

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. The upload validation checks were not 100% robust which left the possibility to circumvent them and upload a potentially dangerous file which allows execution of arbitrary JavaScript in the browser. Additionally we've discovered that Nginx's `proxy_pass` directive will strip some headers negating protections built into Kiwi TCMS when served behind a reverse proxy. This issue has been addressed in version 12.4. Users are advised to upgrade. Users unable to upgrade who are serving Kiwi TCMS behind a reverse proxy should make sure that additional header values are still passed to the client browser. If they aren't redefining them inside the proxy configuration.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
kiwitcms	Kiwi	< 12.4

References

https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L66-L68Product
https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L87Product
https://github.com/kiwitcms/Kiwi/commit/d789f4b51025de4f8c747c037d02e1b0da80b034Patch
https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2fqm-m4r2-fh98Mitigation, Vendor Advisory
https://huntr.dev/bounties/6aea9a26-e29a-467b-aa5a-f767f0c2ec96/Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L66-L68Product
https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L87Product
https://github.com/kiwitcms/Kiwi/commit/d789f4b51025de4f8c747c037d02e1b0da80b034Patch
https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2fqm-m4r2-fh98Mitigation, Vendor Advisory
https://huntr.dev/bounties/6aea9a26-e29a-467b-aa5a-f767f0c2ec96/Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jun 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-339796.5gpt_academic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gpt_academic 3.37 and prior. This issue affects so CVE-2023-33987.5Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.CVE-2023-339807.5Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service (repeated application crashes) v CVE-2023-339816.5Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofed message would need CVE-2023-339825.9Bramble Handshake Protocol (BHP) in Briar before 1.5.3 is not forward secure: eavesdroppers can decrypt network traffic between two accounts CVE-2023-339837.4The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees. An introducer CVE-2023-339845.4SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an au CVE-2023-339856.1SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected CVE-2023-339866.1SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in CVE-2023-339879.4An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7 CVE-2023-339886.1In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Poli CVE-2023-339898.1An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) - versions 707, 737, 747, 757, can exploit a directory