VulnerabilityAnalyzed

CVE-2024-36118

There are no known workarounds for this vulnerability.

MEDIUM 4.3EPSS 0.30%

Does this matter?

Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.

Description

MeterSphere is a test management and interface testing tool. In affected versions users without workspace permissions can view functional test cases of other workspaces beyond their authority. This issue has been addressed in version 2.10.15-lts. Users of MeterSphere are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS: 0.30% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: metersphere/metersphere
Source: security-advisories@github.com

References

https://github.com/metersphere/metersphere/security/advisories/GHSA-qxx2-p3w2-w4r6Vendor Advisory
https://github.com/metersphere/metersphere/security/advisories/GHSA-qxx2-p3w2-w4r6Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.