Metersphere vulnerabilities

Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allows an unauthenticated attacker to log in to the system as any user. This issue has been patched in version 2.10.25-lts.

Metersphere is an open-source testing framework that allows file uploads with a `belongType` value containing a relative path, which may lead to overwriting an existing file or creating a new one. Attackers can only overwrite files that the Metersphere process has access to.

Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks, allowing ordinary users to execute operations reserved for space or project administrators.