What is CVE-2023-25573?

CVE-2023-25573 is a high-severity vulnerability in Metersphere, classified under Missing Authorization. CVSS score: 8.6/10. Published 2023-03-09.

How severe is CVE-2023-25573?

High severity. CVSS v3 base score is 8.6 out of 10.

Is CVE-2023-25573 known to be exploited?

10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Metersphere

CVE-2023-25573

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerability class: Broken Access Control

EPSS: 0.516 (98.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

Affected products

Metersphere — versions < 1.20.20 lts, >= 2.0.0, < 2.7.1

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2023-25573?: CVE-2023-25573 is a high-severity vulnerability in Metersphere, classified under Missing Authorization. CVSS score: 8.6/10. Published 2023-03-09.
How severe is CVE-2023-25573?: High severity. CVSS v3 base score is 8.6 out of 10.
Is CVE-2023-25573 known to be exploited?: 10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.