PT-2023-31520 · Unknown · Metersphere

Mrzbb · Publicado 2023-12-28 · Atualizado 2024-01-04 · CVE-2023-50267

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MeterSphere versions prior to 2.10.10-lts

Description MeterSphere is a one-stop open source continuous testing platform. The issue allows authenticated attackers to update resources that do not belong to them if the resource ID is known.

Recommendations For versions prior to 2.10.10-lts, update to version 2.10.10-lts to resolve the issue. As a temporary workaround, consider restricting access to resource update functionality to minimize the risk of exploitation.

Exploit

Correção

IDOR

Improper Privilege Management

Enumeração de Fraquezas

CWE-639

CWE-269

Identificadores relacionados

CVE-2023-50267

GHSA-RCP4-C5P2-58V9

Produtos afetados

Metersphere

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50267.json · Exploit
• https://github.com/metersphere/metersphere/security/advisories/GHSA-rcp4-c5p2-58v9 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1740426690759692608 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-50267 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-50267 · Nota de Segurança
• https://twitter.com/CVEnew/status/1740393866912551066 · Publicação no Twitter