PT-2023-22777 · Unknown · Metersphere

Lujiefsi · Published 2023-05-04 · Updated 2023-05-10 · CVE-2023-30550

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MeterSphere versions prior to 2.9.0

Description The issue is an IDOR vulnerability that allows the administrator of a project to modify other projects under the workspace, potentially granting an attacker some operating permissions. MeterSphere is an open source continuous testing platform that covers functions such as test tracking, interface testing, UI testing, and performance testing.

Recommendations For versions prior to 2.9.0, update to version 2.9.0 to resolve the issue. As a temporary workaround, consider restricting project modification permissions to minimize the risk of exploitation.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-30550

GHSA-J5CQ-CPW2-GP2Q

Affected Products

Metersphere

References · 6

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-j5cq-cpw2-gp2q · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30550.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-30550 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30550 · Vendor Advisory
• https://github.com/metersphere/metersphere/releases/tag/v2.9.0 · Note
• https://t.me/cibsecurity/63310 · Telegram Post