PT-2023-23972 · Unknown · Metersphere

Fit2-Zhao · Published 2023-05-30 · Updated 2023-06-06 · CVE-2023-32699

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MeterSphere versions 2.9.1 and prior

Description MeterSphere is an open source continuous testing platform. The issue arises when a user submits a very long password during login, forcing the system to execute the long password MD5 encryption process using the checkUserPassword method and the CodingUtil.md5 method. This causes the server CPU and memory to be exhausted, leading to a denial of service attack on the server.

Recommendations For versions 2.9.1 and prior, update to version 2.10.0-lts, which includes a fix with a maximum password length to prevent this issue. As a temporary workaround, consider restricting the password length to prevent excessive MD5 encryption processes.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2023-32699

GHSA-QFFQ-8GF8-MHQ7

Affected Products

Metersphere

References · 6

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-qffq-8gf8-mhq7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32699.json · Exploit
• https://github.com/metersphere/metersphere/commit/c59e381d368990214813085a1a4877c5ef865411 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-32699 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32699 · Vendor Advisory
• https://t.me/cvenotify/51831 · Telegram Post