Fit2-Zhao

**Name of the Vulnerable Software and Affected Versions** MeterSphere versions prior to 2.10.7 LTS **Description** The issue concerns a weak password used by default in the Selenium VNC config of MeterSphere, allowing attackers to login to VNC and obtain high permissions. **Recommendations** For versions prior to 2.10.7 LTS, upgrade to version 2.10.7 LTS or later to resolve the issue. As a temporary workaround, consider changing the default VNC password to a stronger one until the upgrade is possible.

**Name of the Vulnerable Software and Affected Versions** MeterSphere versions 2.9.1 and prior **Description** MeterSphere is an open source continuous testing platform. The issue arises when a user submits a very long password during login, forcing the system to execute the long password MD5 encryption process using the `checkUserPassword` method and the `CodingUtil.md5` method. This causes the server CPU and memory to be exhausted, leading to a denial of service attack on the server. **Recommendations** For versions 2.9.1 and prior, update to version 2.10.0-lts, which includes a fix with a maximum password length to prevent this issue. As a temporary workaround, consider restricting the password length to prevent excessive MD5 encryption processes.

**Name of the Vulnerable Software and Affected Versions** MeterSphere versions prior to 2.4.1 **Description** The issue concerns a Path Injection vulnerability in the `ApiTestCaseService::deleteBodyFiles` function, which takes a user-controlled string `id` and uses the provided value (`testId`) to construct a file path. This allows an attacker to target files on the server by adding specific parameters to the URL. The vulnerability has been fixed in version 2.4.1. **Recommendations** For versions prior to 2.4.1, update to version 2.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the `ApiTestCaseService::deleteBodyFiles` function to minimize the risk of exploitation. Avoid using user-controlled input for the `testId` variable in the affected API endpoint until the issue is resolved.