PT-2023-28136 · Selenium+1 · Selenium+1

Fit2-Zhao · Published 2023-09-26 · Updated 2023-09-30 · CVE-2023-41878

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions MeterSphere versions prior to 2.10.7 LTS

Description The issue concerns a weak password used by default in the Selenium VNC config of MeterSphere, allowing attackers to login to VNC and obtain high permissions.

Recommendations For versions prior to 2.10.7 LTS, upgrade to version 2.10.7 LTS or later to resolve the issue. As a temporary workaround, consider changing the default VNC password to a stronger one until the upgrade is possible.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-41878

GHSA-88VV-6RM4-59H9

Affected Products

Metersphere

Selenium

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41878.json · Exploit
• https://github.com/metersphere/metersphere/security/advisories/GHSA-88vv-6rm4-59h9 · Patch
• https://github.com/metersphere/installer/commit/02dd31c0951a225eaad99eda560e3eb91ba3001d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-41878 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41878 · Vendor Advisory
• https://twitter.com/CVEnew/status/1706851416168366291 · Twitter Post