PT-2023-25976 · Unknown · Metersphere

Lujiefsi · Published 2023-07-17 · Updated 2023-07-27 · CVE-2023-37461

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Metersphere versions prior to 2.10.3

Description Metersphere is an open-source testing framework. Files uploaded to Metersphere may define a belongType value with a relative path like ../../../../ which may cause Metersphere to attempt to overwrite an existing file in the defined location or to create a new file. Attackers would be limited to overwriting files that the Metersphere process has access to.

Recommendations For versions prior to 2.10.3, upgrade to version 2.10.3 to address the issue. As a temporary workaround, consider restricting file uploads or limiting access to sensitive files until the upgrade is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-37461

GHSA-XFR9-JGFP-FX3V

Affected Products

Metersphere

References · 5

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-xfr9-jgfp-fx3v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37461.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-37461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37461 · Security Note
• https://t.me/cibsecurity/66860 · Telegram Post