PT-2023-28136 · Selenium+1 · Selenium+1

Fit2-Zhao · Publicado 2023-09-26 · Atualizado 2023-09-30 · CVE-2023-41878

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions MeterSphere versions prior to 2.10.7 LTS

Description The issue concerns a weak password used by default in the Selenium VNC config of MeterSphere, allowing attackers to login to VNC and obtain high permissions.

Recommendations For versions prior to 2.10.7 LTS, upgrade to version 2.10.7 LTS or later to resolve the issue. As a temporary workaround, consider changing the default VNC password to a stronger one until the upgrade is possible.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2023-41878

GHSA-88VV-6RM4-59H9

Produtos afetados

Metersphere

Selenium

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41878.json · Exploit
• https://github.com/metersphere/metersphere/security/advisories/GHSA-88vv-6rm4-59h9 · Correção
• https://github.com/metersphere/installer/commit/02dd31c0951a225eaad99eda560e3eb91ba3001d · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-41878 · Nota de Segurança
• https://twitter.com/CVEnew/status/1706851416168366291 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-41878 · Aviso do Fabricante