CVE-2023-50267
Assigner: GitHub_M
Published: 2023-12-28T15:13:34.769Z
State: PUBLISHED
title: MeterSphere horizontal privilege escalation vulnerability of resources in project scope.
problemTypes: descriptions: cweId: CWE-269
description: CWE-269: Improper Privilege Management
type: CWE
descriptions: cweId: CWE-639
description: CWE-639: Authorization Bypass Through User-Controlled Key
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
affected: vendor: metersphere
product: metersphere
versions: version: < 2.10.10-lts
status: affected
descriptions: value: MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts.  There are no known workarounds.
source: advisory: GHSA-rcp4-c5p2-58v9
discovery: UNKNOWN