What is the CVSS score of CVE-2023-32699?

CVE-2023-32699 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Is there a public PoC exploit available for CVE-2023-32699?

Yes, a public proof-of-concept exploit is available for CVE-2023-32699. Prioritise patching immediately. EPSS: 0.6%.

Is there a patch available for CVE-2023-32699?

Yes, a patch is available for CVE-2023-32699. Update the affected software to the latest version immediately.

Metersphere CVE-2023-32699

MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2023-05-30 security-advisories@github.com

Denial Of Service Metersphere

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

May 30, 2023 - 19:15 nvd

MEDIUM 6.5

DescriptionNVD

MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. The checkUserPassword method is used to check whether the password provided by the user matches the password saved in the database, and the CodingUtil.md5 method is used to encrypt the original password with MD5 to ensure that the password will not be saved in plain text when it is stored. If a user submits a very long password when logging in, the system will be forced to execute the long password MD5 encryption process, causing the server CPU and memory to be exhausted, thereby causing a denial of service attack on the server. This issue is fixed in version 2.10.0-lts with a maximum password length.

AnalysisAI

MeterSphere is an open source continuous testing platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Allocation of Resources Without Limits (CWE-770), which allows attackers to exhaust system resources through uncontrolled allocation. MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. The checkUserPassword method is used to check whether the password provided by the user matches the password saved in the database, and the CodingUtil.md5 method is used to encrypt the original password with MD5 to ensure that the password will not be saved in plain text when it is stored. If a user submits a very long password when logging in, the system will be forced to execute the long password MD5 encryption process, causing the server CPU and memory to be exhausted, thereby causing a denial of service attack on the server. This issue is fixed in version 2.10.0-lts with a maximum password length. Affected products include: Metersphere. Version information: Version 2.9.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Set resource limits, implement rate limiting, validate input sizes.