CVE-2022-23544

High

Description

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in `IssueProxyResourceService::getMdImageByUrl` allows an attacker to access internal resources, as well as executing JavaScript code in the context of Metersphere's origin by a victim of a reflected XSS. This vulnerability has been fixed in v2.5.0. There are no known workarounds.

SeverityHigh

CVSS7.2

Exploit probability—

ProductMetersphere

PublishedDec 28, 2022

First seenDec 28, 2022

Weakness typeCWE-918Server-side request forgery (SSRF)CWE-79Cross-site scripting (XSS)

How to fix

Update

metersphere metersphere2.5.0 or later

Affected products

Product	Affected versions	Fixed in
metersphere metersphere	v < 2.5.0	2.5.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.