PT-2023-20172 · Unknown · Metersphere

Superxiaoxiong · Published 2023-03-09 · Updated 2023-03-15 · CVE-2023-25573

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions metersphere versions prior to 1.20.20 lts metersphere versions prior to 2.7.1

Description metersphere is an open source continuous testing platform. An improper access control issue exists in "/api/jmeter/download/files", which allows any user to download any file without authentication. This may expose all files available to the running process.

Recommendations For versions prior to 1.20.20 lts, upgrade to version 1.20.20 lts or later. For versions prior to 2.7.1, upgrade to version 2.7.1 or later. As a temporary workaround, consider restricting access to the "/api/jmeter/download/files" endpoint until a patch is available.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-25573

GHSA-MCWR-J9VM-5G8H

Affected Products

Metersphere

References · 7

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-mcwr-j9vm-5g8h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25573.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-25573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25573 · Security Note
• https://t.me/cvenotify/45867 · Telegram Post
• https://t.me/cvenotify/45878 · Telegram Post
• https://t.me/cibsecurity/59737 · Telegram Post