GHSA-7x6q-3v3m-cwjg

kiwi TCMS has possibility for user to update email address to unverified one

Source: GitHub Advisory Database (reviewed) Low CVE-2023-30544

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	kiwitcms	< 12.2	12.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact In previous versions of Kiwi TCMS users were able to update their email addresses via the "My profile" admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. ### Patches With Kiwi TCMS v12.2 or later it is not possible to edit the email field associated with a user account! ### Workarounds No workaround exists. ### References Disclosed by [@novemberdad](https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/).

References

External links from the advisory. They lead to third-party sites.

https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjg web
https://nvd.nist.gov/vuln/detail/CVE-2023-30544 advisory
https://github.com/kiwitcms/Kiwi package
https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85 web
https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122 web