CVE-2023-25814

CVSS V2 None CVSS V3 None
Description
metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations is able to append a path to their submission query which will be read by the system and displayed to the user. This allows a users of the system to read arbitrary files on the filesystem of the server so long as the server process itself has permission to read the requested files. This issue has been addressed in version 2.7.1. All users are advised to upgrade. There are no known workarounds for this issue.
Overview
  • CVE ID
  • CVE-2023-25814
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-03-09T18:15:09
  • Last Modified Date
  • 2023-03-15T16:35:07
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:metersphere:metersphere:*:*:*:*:*:*:*:* 1 OR 2.7.1
References
Reference URL Reference Tags
https://github.com/metersphere/metersphere/security/advisories/GHSA-fwc3-5h55-mh2j Exploit Third Party Advisory
History
Created Old Value New Value Data Type Notes
2023-04-17 06:09:59 Added to TrackCVE
2023-04-17 06:10:03 Weakness Enumeration new