CVE-2024-36118 Unauthorized viewing of workspace test cases in MeterSphere

What is CVE-2024-36118?

CVE-2024-36118 is a low-severity missing authorization vulnerability in metersphere, published on 30 May 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

MeterSphere is a test management and interface testing tool. In affected versions users without workspace permissions can view functional test cases of other workspaces beyond their authority. This issue has been addressed in version 2.10.15-lts. Users of MeterSphere are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-200

Which versions are affected by CVE-2024-36118?

It affects 1 product.

Products include Metersphere Metersphere.

How do I fix CVE-2024-36118?

No fix has been published for CVE-2024-36118 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-36118 being exploited?

There is no known exploitation of CVE-2024-36118 in the wild and no public exploit code.

Other vulnerabilities in metersphere

• CVE-2023-29944 Command injection in n/a Critical 9.8
• CVE-2021-45790 File upload in n/a Critical 9.8
• CVE-2021-45788 SQL injection in n/a High 8.8
• CVE-2023-25573 Improper access control to download file in metersphere High 8.6
• CVE-2022-23512 Metersphere is vulnerable to Path Injection. High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qxx2-p3w2-w4r6.