PT-2023-25394 · Unknown · Metersphere

Lujiefsi · Publicado 2023-07-06 · Atualizado 2023-07-12 · CVE-2023-35937

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Metersphere versions prior to 2.10.2 LTS

Description Metersphere is an open source continuous testing platform. In the affected versions, some key APIs lack permission checks, allowing ordinary users to execute APIs that can only be executed by space administrators or project administrators. For example, ordinary users can be updated as space administrators.

Recommendations For versions prior to 2.10.2 LTS, update to version 2.10.2 LTS to resolve the issue. As a temporary workaround, consider restricting access to key APIs to minimize the risk of exploitation.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-35937

GHSA-7XJ3-QRX5-524R

Produtos afetados

Metersphere

Referências · 5

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-7xj3-qrx5-524r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35937.json · Exploit
• https://t.me/cvenotify/54148 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-35937 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-35937 · Nota de Segurança