CVE-2023-25573 Improper access control to download file in metersphere

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

CVE-2023-25814: Improper Limitation of a Pathname to a Restricted Directory

metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations is able to append a path to their submission query which will be read by the system and displayed to the user. This allows a users of the...

MeterSphere 路径遍历漏洞

MeterSphere is MeterSphere open source one-stop open source continuous testing platform. MeterSphere 2.7.1 before the version of the path traversal vulnerability , the vulnerability stems from the user in the UI operation to create a resource file in the process of the path will be appended to th...

MeterSphere 安全漏洞

MeterSphere is MeterSphere open source one-stop open source continuous testing platform. MeterSphere versions before 1.20.20 lts and 2.7.1 have a security vulnerability that stems from incorrect access control in the file /api/jmeter/download/files, which can be exploited by an attacker to downlo...

CVE-2023-25573: Missing Authorization

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

PT-2023-20323

Name of the Vulnerable Software and Affected Versions metersphere versions prior to 2.7.1 Description The issue allows a user with permission to create a resource file through UI operations to append a path to their submission query, which will be read by the system and displayed to the user. Thi...

GHSA-9P62-X3C5-HR5P Path Traversal In MeterSpere leads to upload file to any path

Summary MeterSphere allow users to upload file, but not check the file name, may lead to upload file to any path if the file name in upload request is falsified. Details Metersphere's FileUtils.java didn't check the filePath. java public static void createFileString filePath, byte fileBytes File...

Path Traversal In MeterSpere leads to upload file to any path

Summary MeterSphere allow users to upload file, but not check the file name, may lead to upload file to any path if the file name in upload request is falsified. Details Metersphere's FileUtils.java didn't check the filePath. java public static void createFileString filePath, byte fileBytes File...

CVE-2022-46178

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability...

Design/Logic Flaw

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability...

CVE-2022-46178

MeterSphere (open source continuous testing platform) contains a path traversal vulnerability in versions prior to 2.5.1 where uploaded files are not validated for the filename, allowing writing to arbitrary paths via FileUtils.createFile by bypassing name checks. The root cause is lack of filena...

CVE-2022-46178 Path Traversal In MeterSpere allows file upload to any path

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability...

CVE-2022-46178 Path Traversal In MeterSpere allows file upload to any path

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability...

CVE-2022-46178 Path Traversal In MeterSpere allows file upload to any path

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability...

PT-2022-27789 · Unknown · Metersphere

Name of the Vulnerable Software and Affected Versions: MeterSphere versions prior to 2.5.1 Description: The issue allows users to upload a file without validating the file name, potentially leading to uploading files to any path if the file name in the upload request is falsified. This is due to ...

CVE-2022-46178: Improper Limitation of a Pathname to a Restricted Directory

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability...

MeterSphere 路径遍历漏洞

MeterSphere is MeterSphere's open source one-stop open source continuous testing platform. A path traversal vulnerability exists in MeterSphere versions prior to 2.5.1 that stems from allowing a user to upload a file but not validate the filename, which could result in uploading the file to an...

CVE-2022-23544

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in...

Design/Logic Flaw

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in...

MeterSphere 代码问题漏洞

MeterSphere is MeterSphere open source one-stop open source continuous testing platform. MeterSphere 2.5.0 before the version of the code problem vulnerability , the vulnerability stems from the existence of server-side request forgery , resulting in reflective cross-site scripting...