PT-2023-22777 · Unknown · Metersphere

Lujiefsi · Publicado 2023-05-04 · Atualizado 2023-05-10 · CVE-2023-30550

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MeterSphere versions prior to 2.9.0

Description The issue is an IDOR vulnerability that allows the administrator of a project to modify other projects under the workspace, potentially granting an attacker some operating permissions. MeterSphere is an open source continuous testing platform that covers functions such as test tracking, interface testing, UI testing, and performance testing.

Recommendations For versions prior to 2.9.0, update to version 2.9.0 to resolve the issue. As a temporary workaround, consider restricting project modification permissions to minimize the risk of exploitation.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-30550

GHSA-J5CQ-CPW2-GP2Q

Produtos afetados

Metersphere

Referências · 6

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-j5cq-cpw2-gp2q · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30550.json · Exploit
• https://github.com/metersphere/metersphere/releases/tag/v2.9.0 · Nota
• https://t.me/cibsecurity/63310 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-30550 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-30550 · Aviso do Fabricante