CVE-2023-25573

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

51.61% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-862

Published

2023-03-09

Updated

2025-02-25

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25573.yaml

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2023/CVE-2023-25573.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2023-25572
• CVE-2023-25581
• CVE-2023-2554
• CVE-2023-25582
• CVE-2023-2553
• CVE-2023-25583