CVE-2023-38494mediumCWE-200

CVE-2023-38494: fallo de gravedad media en metersphere

The cloud version of the MeterSphere interface leaks some sensitive data without authentication

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear metersphere

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.9epss 0.5%
MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for this issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H
Productos afectados
metersphere · metersphere
CVEs relacionadas — metersphere

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-25573HIGHImproper access control to download file in metersphereEPSS 51.6%CVE-2022-23544HIGHServer-Side Request Forgery in Metersphere leads to Cross-Site ScriptingEPSS 1.7%CVE-2022-23512HIGHMetersphere is vulnerable to Path Injection.EPSS 0.9%CVE-2023-25814HIGHArbitrary File Read Vulnerability in metersphereEPSS 0.9%CVE-2022-46178HIGHPath Traversal In MeterSpere allows file upload to any pathEPSS 0.8%CVE-2023-35937MEDIUMMetersphere missing permission checkEPSS 0.7%