PT-2023-31520 · Unknown · Metersphere

Mrzbb · Published 2023-12-28 · Updated 2024-01-04 · CVE-2023-50267

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MeterSphere versions prior to 2.10.10-lts

Description MeterSphere is a one-stop open source continuous testing platform. The issue allows authenticated attackers to update resources that do not belong to them if the resource ID is known.

Recommendations For versions prior to 2.10.10-lts, update to version 2.10.10-lts to resolve the issue. As a temporary workaround, consider restricting access to resource update functionality to minimize the risk of exploitation.

Exploit

Fix

IDOR

Improper Privilege Management

Weakness Enumeration

CWE-639

CWE-269

Related Identifiers

CVE-2023-50267

GHSA-RCP4-C5P2-58V9

Affected Products

Metersphere

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50267.json · Exploit
• https://github.com/metersphere/metersphere/security/advisories/GHSA-rcp4-c5p2-58v9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50267 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50267 · Security Note
• https://twitter.com/VulmonFeeds/status/1740426690759692608 · Twitter Post
• https://twitter.com/CVEnew/status/1740393866912551066 · Twitter Post