CVE-2025-62604
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allows an unauthenticated attacker to log in to the system as any user. This issue has been patched in version 2.10.25-lts.
Risk Assessment
An unauthenticated attacker can take over any user account, including administrator, gaining full access to the testing platform and its data.
Recommendation
Update MeterSphere to version 2.10.25-lts or later. Until patched, restrict network access to the instance.
Other vulnerabilities in MeterSphere
See all- CVE-2023-37461Medium
Metersphere is an open-source testing framework that allows file uploads with a `belongType` value containing a relative path, which may lead to overwriting an existing file or creating a new one. Attackers can only overwrite files that the Metersphere process has access to.
- CVE-2023-35937Medium
Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks, allowing ordinary users to execute operations reserved for space or project administrators.
Original NVD description (English source)
MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allows an unauthenticated attacker to log in to the system as any user. This issue has been patched in version 2.10.25-lts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS