PT-2023-31520

CVE-2023-50267

Published

2023-12-28

Updated

2024-01-04

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MeterSphere versions prior to 2.10.10-lts

Description MeterSphere is a one-stop open source continuous testing platform. The issue allows authenticated attackers to update resources that do not belong to them if the resource ID is known.

Recommendations For versions prior to 2.10.10-lts, update to version 2.10.10-lts to resolve the issue. As a temporary workaround, consider restricting access to resource update functionality to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-269: Improper Privilege Management

Related identifiers

CVE-2023-50267