by Kastro
Paper/Archive/CVE-2023-41878

CVE-2023-41878

metersphere metersphere — Weak password of selenium VNC in MeterSphere

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.4.524 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high permissions. This issue has been addressed in version 2.10.7 LTS. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected

ProductAffectedFixed inSource
metersphere< 2.10.7 LTS–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/metersphere/metersphere/security/advisories/GHSA-88vv-6rm4-59h9refgithub.com/metersphere/installer/commit/02dd31c0951a225eaad99eda560e3eb91ba3001d