CVE-2023-30550 IDOR vulnerability exists in metersphere
An IDOR vulnerability in MeterSphere allows project administrators to modify other projects within the workspace, leading to unauthorized privilege escalation and data modification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-30550?
CVE-2023-30550 is a medium-severity missing authorization vulnerability in metersphere, published on 4 May 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing. This IDOR vulnerability allows the administrator of a project to modify other projects under the workspace. An attacker can obtain some operating permissions. The issue has been fixed in version 2.9.0.
Weakness: CWE-639
Which versions are affected by CVE-2023-30550?
It affects 1 product.
Products include Metersphere Metersphere.
How do I fix CVE-2023-30550?
No fix has been published for CVE-2023-30550 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-30550 being exploited?
There is no known exploitation of CVE-2023-30550 in the wild and no public exploit code.
Other vulnerabilities in metersphere
Sources
Also known as GHSA-j5cq-cpw2-gp2q.