CVE-2023-37461
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Metersphere is an open-source testing framework that allows file uploads with a `belongType` value containing a relative path, which may lead to overwriting an existing file or creating a new one. Attackers can only overwrite files that the Metersphere process has access to.
Risk Assessment
This vulnerability may lead to unauthorized file overwriting, which can affect data integrity within the system. Organizations should be aware of the risk associated with the Metersphere process accessing sensitive files.
Recommendation
It is recommended to upgrade to version 2.10.3 to patch this vulnerability. There are no known workarounds for this issue.
Original NVD description (English source)
Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which may cause metersphere to attempt to overwrite an existing file in the defined location or to create a new file. Attackers would be limited to overwriting files that the metersphere process has access to. This issue has been addressed in version 2.10.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.