PT-2023-23972 · Unknown · Metersphere

Fit2-Zhao · Publicado 2023-05-30 · Atualizado 2023-06-06 · CVE-2023-32699

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MeterSphere versions 2.9.1 and prior

Description MeterSphere is an open source continuous testing platform. The issue arises when a user submits a very long password during login, forcing the system to execute the long password MD5 encryption process using the checkUserPassword method and the CodingUtil.md5 method. This causes the server CPU and memory to be exhausted, leading to a denial of service attack on the server.

Recommendations For versions 2.9.1 and prior, update to version 2.10.0-lts, which includes a fix with a maximum password length to prevent this issue. As a temporary workaround, consider restricting the password length to prevent excessive MD5 encryption processes.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2023-32699

GHSA-QFFQ-8GF8-MHQ7

Produtos afetados

Metersphere

Referências · 6

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-qffq-8gf8-mhq7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32699.json · Exploit
• https://github.com/metersphere/metersphere/commit/c59e381d368990214813085a1a4877c5ef865411 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-32699 · Nota de Segurança
• https://t.me/cvenotify/51831 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-32699 · Aviso do Fabricante