CVE-2023-38494 The cloud version of the MeterSphere interface leaks some sensitive data without authentication

What is CVE-2023-38494?

CVE-2023-38494 is a medium-severity missing authorization vulnerability in metersphere, published on 4 Aug 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for this issue.

Weakness: CWE-862, CWE-200

Which versions are affected by CVE-2023-38494?

It affects 1 product.

Products include Metersphere Metersphere.

How do I fix CVE-2023-38494?

No fix has been published for CVE-2023-38494 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-38494 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38494 exists.

Other vulnerabilities in metersphere

• CVE-2023-29944 Command injection in n/a Critical 9.8
• CVE-2021-45790 File upload in n/a Critical 9.8
• CVE-2021-45788 SQL injection in n/a High 8.8
• CVE-2023-25573 Improper access control to download file in metersphere High 8.6
• CVE-2022-23512 Metersphere is vulnerable to Path Injection. High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fjp5-95pv-5253.