CVE-2022-23512highCWE-22

CVE-2022-23512: falha de alta gravidade em metersphere

Metersphere is vulnerable to Path Injection.

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar metersphere

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.9%
MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFiles which takes a user-controlled string id and passes it to ApiTestCaseService, which uses the user-provided value (testId) in new File(BODY_FILE_DIR + "/" + testId), being deleted later by file.delete(). By adding some camouflage parameters to the url, an attacker can target files on the server. The vulnerability has been fixed in v2.4.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Produtos afetados
metersphere · metersphere
CVEs relacionadas — metersphere

No mesmo produto, das mais perigosas para as menos.

CVE-2023-25573HIGHImproper access control to download file in metersphereEPSS 51.6%CVE-2022-23544HIGHServer-Side Request Forgery in Metersphere leads to Cross-Site ScriptingEPSS 1.7%CVE-2023-25814HIGHArbitrary File Read Vulnerability in metersphereEPSS 0.9%CVE-2022-46178HIGHPath Traversal In MeterSpere allows file upload to any pathEPSS 0.8%CVE-2023-35937MEDIUMMetersphere missing permission checkEPSS 0.7%CVE-2023-41878MEDIUMWeak password of selenium VNC in MeterSphereEPSS 0.7%