CVE-2023-33977
2 advisories.
PyPI/kiwitcms CVE-2023-33977: high 8.1, EPSS 0.87%
kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload
Action: Upgrade kiwitcms to 12.4 or later.
pip install kiwitcms==12.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 12.4 | - |
Fixed versions
| 12.4 |
Sources
- osv: GHSA-2fqm-m4r2-fh98
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2fqm-m4r2-fh98
- https://nvd.nist.gov/vuln/detail/CVE-2023-33977
- https://github.com/kiwitcms/kiwi/commit/d789f4b51025de4f8c747c037d02e1b0da80b034
- https://github.com/kiwitcms/Kiwi
- https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L66-L68
- https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L87
- https://huntr.dev/bounties/6aea9a26-e29a-467b-aa5a-f767f0c2ec96
- https://kiwitcms.org/blog/kiwi-tcms-team/2023/06/06/kiwi-tcms-124
CVE-2023-33977 · published · modified · JSON
PyPI/kiwitcms CVE-2023-33977: high 8.1, EPSS 0.87%
kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload
Action: Upgrade kiwitcms to 12.4 or later.
pip install kiwitcms==12.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 12.4 | - |
Fixed versions
| 12.4 |
Sources
- osv: PYSEC-2026-1495
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2fqm-m4r2-fh98
- https://nvd.nist.gov/vuln/detail/CVE-2023-33977
- https://github.com/kiwitcms/kiwi/commit/d789f4b51025de4f8c747c037d02e1b0da80b034
- https://github.com/kiwitcms/Kiwi
- https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L66-L68
- https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L87
- https://huntr.dev/bounties/6aea9a26-e29a-467b-aa5a-f767f0c2ec96
- https://kiwitcms.org/blog/kiwi-tcms-team/2023/06/06/kiwi-tcms-124
- https://pypi.org/project/kiwitcms
- https://github.com/advisories/GHSA-2fqm-m4r2-fh98
CVE-2023-33977 · published · modified · JSON