CVE-2023-30550

MediumCVSS 4.5/10Last modified Jun 17, 2026

Description

MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing. This IDOR vulnerability allows the administrator of a project to modify other projects under the workspace. An attacker can obtain some operating permissions. The issue has been fixed in version 2.9.0.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
metersphere	metersphere	< 2.9.0

References

https://github.com/metersphere/metersphere/releases/tag/v2.9.0Release Notes
https://github.com/metersphere/metersphere/security/advisories/GHSA-j5cq-cpw2-gp2qExploit, Third Party Advisory
https://github.com/metersphere/metersphere/releases/tag/v2.9.0Release Notes
https://github.com/metersphere/metersphere/security/advisories/GHSA-j5cq-cpw2-gp2qExploit, Third Party Advisory

Timeline

Published: May 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-305517.5Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions CVE-2023-305526.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305536.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305546.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305556.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305566.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305576.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305586.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-305595.7The firmware update package for the wireless card is not properly signed and can be modified.CVE-2023-30569.8A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown code of the file ind CVE-2023-305606.8The configuration from the PCU can be modified without authentication using physical connection to the PCU.CVE-2023-305616.1The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by a