CVE-2023-32699

Public Exploit
MeterSphere denial of service vulnerability

Description

MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. ​The `checkUserPassword` method is used to check whether the password provided by the user matches the password saved in the database, and the `CodingUtil.md5` method is used to encrypt the original password with MD5 to ensure that the password will not be saved in plain text when it is stored. If a user submits a very long password when logging in, the system will be forced to execute the long password MD5 encryption process, causing the server CPU and memory to be exhausted, thereby causing a denial of service attack on the server. This issue is fixed in version 2.10.0-lts with a maximum password length.

Category

6.5
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.71% Top 30%
Vendor Advisory github.com
Affected: metersphere metersphere
Published at:
Updated at:

References

Link Tags
https://github.com/metersphere/metersphere/security/advisories/GHSA-qffq-8gf8-mhq7 vendor advisory exploit
https://github.com/metersphere/metersphere/commit/c59e381d368990214813085a1a4877c5ef865411 patch

Frequently Asked Questions

What is the severity of CVE-2023-32699?
CVE-2023-32699 has been scored as a medium severity vulnerability.
How to fix CVE-2023-32699?
To fix CVE-2023-32699, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-32699 being actively exploited in the wild?
It is possible that CVE-2023-32699 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-32699?
CVE-2023-32699 affects metersphere metersphere.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.