CVE-2022-23544 Server-Side Request Forgery in Metersphere leads to Cross-Site Scripting

High 7.2 Published 27 Dec 2022 Updated 11 Apr 2025

An attacker can exploit SSRF to access internal resources and trigger reflected XSS, potentially executing JavaScript in the victim's browser context.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-23544?

CVE-2022-23544 is a high-severity server-side request forgery vulnerability in metersphere, published on 27 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in `IssueProxyResourceService::getMdImageByUrl` allows an attacker to access internal resources, as well as executing JavaScript code in the context of Metersphere's origin by a victim of a reflected XSS. This vulnerability has been fixed in v2.5.0. There are no known workarounds.

Weakness: CWE-918, CWE-79

Which versions are affected by CVE-2022-23544?

It affects 1 product.

Products include Metersphere Metersphere.

How do I fix CVE-2022-23544?

No fix has been published for CVE-2022-23544 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2022-23544 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23544 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-vrv6-cg45-rmjj.