CVE-2023-35937mediumCWE-862

CVE-2023-35937: fallo de gravedad media en metersphere

Metersphere missing permission check

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear metersphere

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6epss 0.7%
Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows ordinary users to execute APIs that can only be executed by space administrators or project administrators. For example, ordinary users can be updated as space administrators. Version 2.10.2 LTS has a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
Productos afectados
metersphere · metersphere
CVEs relacionadas — metersphere

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-25573HIGHImproper access control to download file in metersphereEPSS 51.6%CVE-2022-23544HIGHServer-Side Request Forgery in Metersphere leads to Cross-Site ScriptingEPSS 1.7%CVE-2022-23512HIGHMetersphere is vulnerable to Path Injection.EPSS 0.9%CVE-2023-25814HIGHArbitrary File Read Vulnerability in metersphereEPSS 0.9%CVE-2022-46178HIGHPath Traversal In MeterSpere allows file upload to any pathEPSS 0.8%CVE-2023-41878MEDIUMWeak password of selenium VNC in MeterSphereEPSS 0.7%