PT-2023-26475 · Unknown · Metersphere

Hbdxmz · Publicado 2023-08-04 · Atualizado 2023-08-08 · CVE-2023-38494

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions MeterSphere versions prior to 2.10.4 LTS

Description MeterSphere is an open-source continuous testing platform. Some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers.

Recommendations For versions prior to 2.10.4 LTS, update to version 2.10.4 LTS to resolve the issue. As a temporary workaround, consider restricting access to sensitive interfaces until the patch is applied.

Exploit

Correção

Missing Authorization

Information Disclosure

Enumeração de Fraquezas

CWE-862

CWE-200

Identificadores relacionados

CVE-2023-38494

GHSA-FJP5-95PV-5253

Produtos afetados

Metersphere

Referências · 7

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-fjp5-95pv-5253 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38494.json · Exploit
• https://github.com/metersphere/metersphere/commit/a23f75d93b666901fd148d834df9384f6f24cf28 · Correção
• https://osv.dev/vulnerability/CVE-2023-38494 · Aviso do Fabricante
• https://t.me/cvenotify/56032 · Publicação no Telegram
• https://t.me/cibsecurity/67773 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-38494 · Nota de Segurança