Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-30544

CVE-2023-30544: kiwi TCMS has possibility for user to update email address to unverified one

4.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-30544
GHSA ID
GHSA-7x6q-3v3m-cwjg
EPSS Score
0.34818%
CWE
CWE-283
Published
4/24/2023
Updated
11/11/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
kiwitcmspip< 12.212.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the admin interface allowing email modification without verification. In Django-based applications like Kiwi TCMS:

  1. UserAdmin classes control editable fields in admin pages
  2. The presence of email field in admin forms/fieldsets enables direct editing
  3. Lack of verification hooks in save_model or form validation would permit unverified changes
  4. The patch explicitly mentions disabling email field editing in admin, implying these were the entry points While exact code isn't available, Django's admin patterns strongly suggest these components as vectors given the vulnerability context.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t In pr*vious v*rsions o* Kiwi T*MS us*rs w*r* **l* to up**t* t**ir *m*il ***r*ss*s vi* t** "My pro*il*" **min p***. T*is p*** *llow** t**m to ***n** t** *m*il ***r*ss r**ist*r** wit* t**ir ***ount wit*out t** own*rs*ip v*ri*i**tion p*r*orm*

Reasoning

T** vuln*r**ility st*ms *rom t** **min int*r**** *llowin* *m*il mo*i*i**tion wit*out v*ri*i**tion. In *j*n*o-**s** *ppli**tions lik* Kiwi T*MS: *. Us*r**min *l*ss*s *ontrol **it**l* *i*l*s in **min p***s *. T** pr*s*n** o* *m*il *i*l* in **min *orms/