CVE-2023-25573

HIGH EXPLOITED NUCLEI

metersphere < 1.20.19 - Unauthenticated Arbitrary File Download via /api/jmeter/download/files

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-25573 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Nuclei Templates (1)

Metersphere - Arbitrary File Read
HIGHVERIFIEDby DhiyaneshDK
Shodan: http.html:"metersphere"
FOFA: body="Metersphere" || body="metersphere" || title="metersphere"

References (1)

Core 1
Core References

Scores

CVSS v3 8.6
EPSS 0.4985
EPSS Percentile 98.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2023-12-04
CWE
CWE-862
Status published
Products (1)
metersphere/metersphere < 1.20.19
Published Mar 09, 2023
Tracked Since Feb 18, 2026