CVE-2022-23544

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in `IssueProxyResourceService::getMdImageByUrl` allows an attacker to access internal resources, as well as executing JavaScript code in the context of Metersphere's origin by a victim of a reflected XSS. This vulnerability has been fixed in v2.5.0. There are no known workarounds.

• CWE-79
• CWE-918
• CWE-918

• https://github.com/metersphere/metersphere/commit/d0f95b50737c941b29d507a4cc3545f2dc6ab121Patch, Third Party Advisory
• https://github.com/metersphere/metersphere/security/advisories/GHSA-vrv6-cg45-rmjjExploit, Patch, Third Party Advisory
• https://github.com/metersphere/metersphere/commit/d0f95b50737c941b29d507a4cc3545f2dc6ab121Patch, Third Party Advisory
• https://github.com/metersphere/metersphere/security/advisories/GHSA-vrv6-cg45-rmjjExploit, Patch, Third Party Advisory

Published

Dec 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23539Versions `<=8.5.1` of `jsonwebtoken` library could be miscon…8.1
• CVE-2022-2354The WP-DBManager WordPress plugin before 2.80.8 does not pre…7.2
• CVE-2022-23540In versions `<=8.5.1` of `jsonwebtoken` library, lack of alg…7.6
• CVE-2022-23541jsonwebtoken is an implementation of JSON Web Tokens. Versio…6.3
• CVE-2022-23542OpenFGA is an authorization/permission engine built for deve…9.8
• CVE-2022-23543Silverware Games is a social network where people can play g…5.4
• CVE-2022-23546In version 2.9.0.beta14 of Discourse, an open-source discuss…5.5
• CVE-2022-23547PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-23548Discourse is an option source discussion platform. Prior to …6.5
• CVE-2022-23549Discourse is an option source discussion platform. Prior to …6.5
• CVE-2022-2355The Easy Username Updater WordPress plugin before 1.0.5 does…6.5
• CVE-2022-23551aad-pod-identity assigns Azure Active Directory identities t…5.3