PT-2023-25394 · Unknown · Metersphere

Lujiefsi · Published 2023-07-06 · Updated 2023-07-12 · CVE-2023-35937

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Metersphere versions prior to 2.10.2 LTS

Description Metersphere is an open source continuous testing platform. In the affected versions, some key APIs lack permission checks, allowing ordinary users to execute APIs that can only be executed by space administrators or project administrators. For example, ordinary users can be updated as space administrators.

Recommendations For versions prior to 2.10.2 LTS, update to version 2.10.2 LTS to resolve the issue. As a temporary workaround, consider restricting access to key APIs to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-35937

GHSA-7XJ3-QRX5-524R

Affected Products

Metersphere

References · 5

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-7xj3-qrx5-524r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35937.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-35937 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35937 · Security Note
• https://t.me/cvenotify/54148 · Telegram Post