CVE-2023-35937CWE-862

Metersphere missing permission check

Medium · published July 6, 2023

CVSS v3.1
6.0
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows ordinary users to execute APIs that can only be executed by space administrators or project administrators. For example, ordinary users can be updated as space administrators. Version 2.10.2 LTS has a patch for this issue.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00711 · 53.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-07-06T13:50Z
EPSS history
Timeline
  • 06 JUL 13:50Z
    Metersphere missing permission check
    cvelistv5