PT-2023-20172 · Unknown · Metersphere

Superxiaoxiong · Publicado 2023-03-09 · Atualizado 2023-03-15 · CVE-2023-25573

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions metersphere versions prior to 1.20.20 lts metersphere versions prior to 2.7.1

Description metersphere is an open source continuous testing platform. An improper access control issue exists in "/api/jmeter/download/files", which allows any user to download any file without authentication. This may expose all files available to the running process.

Recommendations For versions prior to 1.20.20 lts, upgrade to version 1.20.20 lts or later. For versions prior to 2.7.1, upgrade to version 2.7.1 or later. As a temporary workaround, consider restricting access to the "/api/jmeter/download/files" endpoint until a patch is available.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-25573

GHSA-MCWR-J9VM-5G8H

Produtos afetados

Metersphere

Referências · 7

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-mcwr-j9vm-5g8h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25573.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-25573 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25573 · Nota de Segurança
• https://t.me/cvenotify/45867 · Publicação no Telegram
• https://t.me/cvenotify/45878 · Publicação no Telegram
• https://t.me/cibsecurity/59737 · Publicação no Telegram