Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS03eDZxLTN2M20tY3dqZ84AAy8N

kiwi TCMS has possibility for user to update email address to unverified one

Impact

In previous versions of Kiwi TCMS users were able to update their email addresses via the "My profile" admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration.

Patches

With Kiwi TCMS v12.2 or later it is not possible to edit the email field associated with a user account!

Workarounds

No workaround exists.

References

Disclosed by @novemberdad.

Permalink: https://github.com/advisories/GHSA-7x6q-3v3m-cwjg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03eDZxLTN2M20tY3dqZ84AAy8N
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: 11 months ago
Updated: 5 months ago


Identifiers: GHSA-7x6q-3v3m-cwjg, CVE-2023-30544
References: Repository: https://github.com/kiwitcms/Kiwi

Affected Packages

pypi:kiwitcms
Dependent packages: 0
Dependent repositories: 1
Downloads: 1,177 last month
Affected Version Ranges: < 12.2
Fixed in: 12.2
All affected versions: 6.2.1, 6.5.3, 7.2.1, 8.1.99, 8.6.1, 10.3.999
All unaffected versions: