PT-2023-25976 · Unknown · Metersphere

Lujiefsi · Publicado 2023-07-17 · Atualizado 2023-07-27 · CVE-2023-37461

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Metersphere versions prior to 2.10.3

Description Metersphere is an open-source testing framework. Files uploaded to Metersphere may define a belongType value with a relative path like ../../../../ which may cause Metersphere to attempt to overwrite an existing file in the defined location or to create a new file. Attackers would be limited to overwriting files that the Metersphere process has access to.

Recommendations For versions prior to 2.10.3, upgrade to version 2.10.3 to address the issue. As a temporary workaround, consider restricting file uploads or limiting access to sensitive files until the upgrade is applied.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-37461

GHSA-XFR9-JGFP-FX3V

Produtos afetados

Metersphere

Referências · 5

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-xfr9-jgfp-fx3v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37461.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-37461 · Aviso do Fabricante
• https://t.me/cibsecurity/66860 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-37461 · Nota de Segurança