CVE-2022-23544 is a Server-Side Request Forgery (SSRF) vulnerability affecting MeterSphere versions prior to 2.5.0, a continuous testing platform. This flaw allows an unauthenticated attacker to access internal resources and, when combined with reflected Cross-Site Scripting (XSS), execute arbitrary JavaScript in the victim's browser context. Rated Medium (CVSS 6.1), the vulnerability requires user interaction (UI:R) but has low attack complexity (AC:L), potentially leading to limited confidentiality and integrity impacts. While no active exploitation is confirmed and it's not on the KEV catalog, public Nuclei templates exist, indicating potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.5.0CPE matchmatch criteria | cpe:2.3:a:metersphere:metersphere:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.