CVE-2023-37461mediumCWE-22

CVE-2023-37461: fallo de gravedad media en metersphere

Path traversal in metersphere

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear metersphere

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.6epss 0.6%
Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which may cause metersphere to attempt to overwrite an existing file in the defined location or to create a new file. Attackers would be limited to overwriting files that the metersphere process has access to. This issue has been addressed in version 2.10.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Productos afectados
metersphere · metersphere
CVEs relacionadas — metersphere

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-25573HIGHImproper access control to download file in metersphereEPSS 51.6%CVE-2022-23544HIGHServer-Side Request Forgery in Metersphere leads to Cross-Site ScriptingEPSS 1.7%CVE-2022-23512HIGHMetersphere is vulnerable to Path Injection.EPSS 0.9%CVE-2023-25814HIGHArbitrary File Read Vulnerability in metersphereEPSS 0.9%CVE-2022-46178HIGHPath Traversal In MeterSpere allows file upload to any pathEPSS 0.8%CVE-2023-35937MEDIUMMetersphere missing permission checkEPSS 0.7%