CVE-2023-32686

Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded...

CVE-2023-32686

Kiwi TCMS before version 12.3 was vulnerable to stored XSS via unrestricted file uploads. Weak upload validators allowed crafted file combinations to bypass Content-Security-Policy, enabling arbitrary JavaScript execution in the browser. The issue is patched in version 12.3. Remediation: upgrade ...