CVE-2022-46178highCWE-22

CVE-2022-46178: falha de alta gravidade em metersphere

Path Traversal In MeterSpere allows file upload to any path

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar metersphere+ Monitorar io.metersphere:metersphere

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.4epss 0.8%
MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability has been fixed in v2.5.1. There are no workarounds.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Produtos afetados
metersphere · metersphere
CVEs relacionadas — metersphere

No mesmo produto, das mais perigosas para as menos.

CVE-2023-25573HIGHImproper access control to download file in metersphereEPSS 51.6%CVE-2022-23544HIGHServer-Side Request Forgery in Metersphere leads to Cross-Site ScriptingEPSS 1.7%CVE-2022-23512HIGHMetersphere is vulnerable to Path Injection.EPSS 0.9%CVE-2023-25814HIGHArbitrary File Read Vulnerability in metersphereEPSS 0.9%CVE-2023-35937MEDIUMMetersphere missing permission checkEPSS 0.7%CVE-2023-41878MEDIUMWeak password of selenium VNC in MeterSphereEPSS 0.7%