CVE-2023-50267

    Dashboard / Vulnerabilities / CVE-2023-50267

    CVE-2023-50267

    Published: 28 Dec 2023Last Modified: 12 Aug 2026

    Summary: MeterSphere horizontal privilege escalation vulnerability of resources in project scope.

    Details: MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are no known workarounds.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50267.json, https://github.com/metersphere/metersphere/security/advisories/GHSA-rcp4-c5p2-58v9, https://nvd.nist.gov/vuln/detail/CVE-2023-50267

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e9b6aa9e9e17bd9a77f64b2e4b15504a18386535

    Affected versions

    v2.10.9-lts
    v2.10.8-lts
    v2.10.7-lts
    v2.10.6-lts
    v2.10.5-lts
    v2.10.4-lts
    v2.10.3-lts
    v2.10.2-lts
    v2.10.1-lts
    v2.10.0-lts

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-50267 | CVE-DB