CVE-2023-32699

MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. ​The `checkUserPassword` method is used to check whether the password provided by the user matches the password saved in the database, and the `CodingUtil.md5` method is used to encrypt the original password with MD5 to ensure that the password will not be saved in plain text when it is stored. If a user submits a very long password when logging in, the system will be forced to execute the long password MD5 encryption process, causing the server CPU and memory to be exhausted, thereby causing a denial of service attack on the server. This issue is fixed in version 2.10.0-lts with a maximum password length.

• CWE-770
• CWE-770

• https://github.com/metersphere/metersphere/commit/c59e381d368990214813085a1a4877c5ef865411Patch
• https://github.com/metersphere/metersphere/security/advisories/GHSA-qffq-8gf8-mhq7Exploit, Vendor Advisory
• https://github.com/metersphere/metersphere/commit/c59e381d368990214813085a1a4877c5ef865411Patch
• https://github.com/metersphere/metersphere/security/advisories/GHSA-qffq-8gf8-mhq7Exploit, Vendor Advisory

Published

May 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32693Decidim is a participatory democracy framework, written in R…6.1
• CVE-2023-32694Saleor Core is a composable, headless commerce API. Saleor's…5.4
• CVE-2023-32695socket.io parser is a socket.io encoder and decoder written …7.5
• CVE-2023-32696CKAN is an open-source data management system for powering d…8.8
• CVE-2023-32697SQLite JDBC is a library for accessing and creating SQLite d…9.8
• CVE-2023-32698nFPM is an alternative to fpm. The file permissions on the c…7.1
• CVE-2023-3270Exposure of Sensitive Information to an Unauthorized Actor i…7.5
• CVE-2023-32700LuaTeX before 1.17.0 allows execution of arbitrary shell com…7.8
• CVE-2023-32701Improper Input Validation in the Networking Stack of QNX SDP…7.1
• CVE-2023-32706On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.1…6.5
• CVE-2023-32707In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.…8.8
• CVE-2023-32708In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.1…8.8