1. Home
  2. CVE Database
  3. CVE-2023-37461
MEDIUM · 5.6

CVE-2023-37461

Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which may cause metersphere to attempt to overwri...

Vulnerability Description

Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which may cause metersphere to attempt to overwrite an existing file in the defined location or to create a new file. Attackers would be limited to overwriting files that the metersphere process has access to. This issue has been addressed in version 2.10.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score

5.6

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
MetersphereMetersphere< 2.10.3

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2023-37461?

CVE-2023-37461 is a vulnerability with a CVSS score of 5.6 (MEDIUM). Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which may cause metersphere to attempt to overwri...

How severe is CVE-2023-37461?

CVE-2023-37461 has been rated MEDIUM with a CVSS base score of 5.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-37461?

Check the references section above for vendor advisories and patch information. Affected products include: Metersphere Metersphere.