PT-2023-26475 · Unknown · Metersphere

Hbdxmz · Published 2023-08-04 · Updated 2023-08-08 · CVE-2023-38494

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions MeterSphere versions prior to 2.10.4 LTS

Description MeterSphere is an open-source continuous testing platform. Some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers.

Recommendations For versions prior to 2.10.4 LTS, update to version 2.10.4 LTS to resolve the issue. As a temporary workaround, consider restricting access to sensitive interfaces until the patch is applied.

Exploit

Fix

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

CVE-2023-38494

GHSA-FJP5-95PV-5253

Affected Products

Metersphere

References · 7

• 🔥 https://github.com/metersphere/metersphere/security/advisories/GHSA-fjp5-95pv-5253 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38494.json · Exploit
• https://github.com/metersphere/metersphere/commit/a23f75d93b666901fd148d834df9384f6f24cf28 · Patch
• https://osv.dev/vulnerability/CVE-2023-38494 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38494 · Security Note
• https://t.me/cvenotify/56032 · Telegram Post
• https://t.me/cibsecurity/67773 · Telegram Post