CVE-2022-46178

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability has been fixed in v2.5.1. There are no workarounds.

Published: Dec 29, 2022
Updated: May 9, 2024
CVE: CVE-2022-46178
GHSA: GHSA-9p62-x3c5-hr5p
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWEs:

CWE-22

OWASP TOP 10:

A5 - Broken Access Control

Affected Software
References

Software	From	Fixed in
metersphere / metersphere	-	2.5.1
io.metersphere / metersphere	-	2.5.1

https://github.com/metersphere/metersphere/blob/v2.5.0/framework/sdk-parent/sdk/src/main/java/io/metersphere/commons/utils/FileUtils.java#L5
https://github.com/metersphere/metersphere/releases/tag/v2.5.1
https://github.com/metersphere/metersphere/security/advisories/GHSA-9p62-x3c5-hr5p

Vulnerability Database

CVE-2022-46178

Deep Security Visibility Without the Complexity