Low severity3.9NVD Advisory· Published Apr 24, 2023· Updated Jun 17, 2026
CVE-2023-30544
CVE-2023-30544
Description
Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the My profile admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
kiwitcmsPyPI | < 12.2 | 12.2 |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-7x6q-3v3m-cwjgghsaADVISORY
- github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjgnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-30544ghsaADVISORY
- huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85ghsaWEB
- huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/nvdPermissions Required
- kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122ghsaWEB
- kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/nvdRelease Notes
- huntr.com/bounties/1714df73-e639-4d64-ab25-ced82dad9f85nvd
News mentions
0No linked articles in our index yet.