CVE-2023-22451

Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the `AUTH_PASSWORD_VALIDATORS` configuration setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen.

• CWE-521
• CWE-521

• https://github.com/kiwitcms/Kiwi/commit/3759fb68aed36315cdde9fc573b2fe7c11544985Patch, Third Party Advisory
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-496x-2jqf-hp7gMitigation, Third Party Advisory
• https://huntr.dev/bounties/32a873c8-f605-4aae-9272-d80985ef2b73Patch, Third Party Advisory
• https://github.com/kiwitcms/Kiwi/commit/3759fb68aed36315cdde9fc573b2fe7c11544985Patch, Third Party Advisory
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-496x-2jqf-hp7gMitigation, Third Party Advisory
• https://huntr.dev/bounties/32a873c8-f605-4aae-9272-d80985ef2b73Patch, Third Party Advisory

Published

Jan 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22444Improper initialization in some Intel(R) NUC 13 Extreme Comp…4.4
• CVE-2023-22447Insertion of sensitive information into log file in the Open…4.4
• CVE-2023-22448Improper access control for some Intel Unison software may a…7.2
• CVE-2023-22449Improper input validation in some Intel(R) NUC BIOS firmware…6.7
• CVE-2023-2245A vulnerability was found in hansunCMS 1.4.3. It has been de…6.3
• CVE-2023-22450 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an…7.2
• CVE-2023-22452kenny2automate is a Discord bot. In the web interface for se…6.5
• CVE-2023-22453Discourse is an option source discussion platform. Prior to …5.3
• CVE-2023-22454Discourse is an option source discussion platform. Prior to …6.1
• CVE-2023-22455Discourse is an option source discussion platform. Prior to …6.1
• CVE-2023-22456ViewVC, a browser interface for CVS and Subversion version c…6.1
• CVE-2023-22457CKEditor Integration UI adds support for editing wiki pages …8.8