← Vulnerability feed

Vulnerability record · CVE-2023-25573 · published 9 March 2023

CVE-2023-25573: MeterSphere missing authorization allows unauthenticated file download

Metersphere · Metersphere

MeterSphere, an open source continuous testing platform, has an improper access control flaw in the /api/jmeter/download/files endpoint. Any unauthenticated user can download arbitrary files readable by the running process, potentially exposing configuration, credentials and test data. The issue is fixed in versions 1.20.20 lts and 2.7.1, with no known workarounds.

7.5 CVSS 3.1 High EPSS 52% · top 1.1% CWE-862 · Missing authorization
7.5CVSS 3.1 base score
52%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable file disclosure with a high CVSS score and very high EPSS probability, though no KEV listing or ransomware use is documented.

What it is

MeterSphere, an open source continuous testing platform, has an improper access control flaw in the /api/jmeter/download/files endpoint. Any unauthenticated user can download arbitrary files readable by the running process, potentially exposing configuration, credentials and test data. The issue is fixed in versions 1.20.20 lts and 2.7.1, with no known workarounds.

Impact

An attacker gains read access to any file the MeterSphere process can read, which may include secrets, configuration files and test artifacts. There is no integrity or availability impact; the loss is confidentiality.

Attack surface

Reachable over the network via the /api/jmeter/download/files endpoint with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV, but EPSS is 0.51609 (98.9th percentile) and the advisory references are tagged Exploit, indicating public exploit material exists.

What to do

  • Upgrade to MeterSphere 1.20.20 lts or 2.7.1 as the primary fix.
  • If upgrade is not immediately possible, restrict network access to the /api/jmeter/download/files endpoint at the reverse proxy or firewall.
  • Run the MeterSphere process with least privilege so its readable file set is minimized.
  • Audit exposed files and rotate any credentials or secrets that may have been readable by the process.

Detection

  • Monitor access logs for requests to /api/jmeter/download/files, especially without a valid session or from unexpected source IPs.
  • Alert on large or unusual file downloads from that endpoint.
  • Review process file access for reads of sensitive paths outside expected MeterSphere data directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/metersphere/metersphere/security/advisories/GHSA-mcwr-j9vm-5g8h ExploitThird Party Advisory
https://github.com/metersphere/metersphere/security/advisories/GHSA-mcwr-j9vm-5g8h ExploitThird Party Advisory

Track CVE-2023-25573 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-41878Metersphere hard-coded credentials vulnerabilityMeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and perfor…EPSS 0.58%9.8CVE-2023-37461Metersphere path traversal vulnerabilityMetersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../…EPSS 0.63%9.8CVE-2023-29944Metersphere os command injection vulnerabilityMetersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snip…EPSS 2.1%9.8CVE-2021-45790Metersphere unrestricted file upload vulnerabilityAn arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to arbitrary directory, where atta…EPSS 1.9%8.8CVE-2023-35937Metersphere missing authorization vulnerabilityMetersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This…EPSS 0.71%8.8CVE-2022-46178Metersphere path traversal vulnerabilityMeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. V…EPSS 0.72%8.8CVE-2021-45788Metersphere sql injection vulnerabilityTime-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.EPSS 3.0%8.1CVE-2022-23512Metersphere path traversal vulnerabilityMeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::de…EPSS 0.84%

Source: NIST National Vulnerability Database (record CVE-2023-25573), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.