| Package | Affected versions | Patched versions |
|---|---|---|
| kiwitcms | < 12.0 | 12.0 |
| kiwi tcms | < 12.0 | 12.0 |
Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page.
Users should upgrade to v12.0 or later.
Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free