CVE-2023-35937
Assigner: GitHub_M
Published: 2023-07-06T13:50:10.673Z
State: PUBLISHED
title: Metersphere missing permission check
problemTypes: descriptions: cweId: CWE-862
description: CWE-862: Missing Authorization
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
version: 3.1
affected: vendor: metersphere
product: metersphere
versions: version: < 2.10.2-LTS
status: affected
descriptions: value: Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows ordinary users to execute APIs that can only be executed by space administrators or project administrators. For example, ordinary users can be updated as space administrators. Version 2.10.2 LTS has a patch for this issue.
source: advisory: GHSA-7xj3-qrx5-524r
discovery: UNKNOWN