CVE-2025-62604

    Dashboard / Vulnerabilities / CVE-2025-62604

    CVE-2025-62604

    Published: 22 Oct 2025Last Modified: 12 Aug 2026

    Summary: MeterSphere logic flaw allows retrieval of arbitrary user information

    Details: MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allows an unauthenticated attacker to log in to the system as any user. This issue has been patched in version 2.10.25-lts.

    References: https://github.com/metersphere/metersphere/releases/tag/v2.10.25-lts, https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62604.json, https://github.com/metersphere/metersphere/security/advisories/GHSA-vj5x-7374-rf96, https://nvd.nist.gov/vuln/detail/CVE-2025-62604, https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e7e1b1f729b7338be804c565b2bf47bb812e2579

    Affected versions

    v2.10.24-lts
    v2.10.23-lts
    v2.10.22-lts
    v2.10.21-lts
    v2.10.20-lts
    v2.10.18-lts
    v2.10.17-lts
    v2.10.16-lts
    v2.10.15-lts
    v2.10.14-lts
    v2.10.13-lts
    v2.10.12-lts
    v2.10.11-lts
    v2.10.10-lts
    v2.10.9-lts
    v2.10.8-lts
    v2.10.7-lts
    v2.10.6-lts
    v2.10.5-lts
    v2.10.4-lts
    v2.10.3-lts
    v2.10.2-lts
    v2.10.1-lts
    v2.10.0-lts

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2025-62604 | CVE-DB