CVE-2023-38494
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, leading to sensitive information leakage by attackers.
Risk Assessment
The lack of proper configuration permissions may lead to unauthorized access to sensitive data, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to version 2.10.4 LTS or later to patch this vulnerability and secure the interfaces against unauthorized access.
Original NVD description (English source)
MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for this issue.