CVE-2023-41878

MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high permissions. This issue has been addressed in version 2.10.7 LTS. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-798

• https://github.com/metersphere/installer/commit/02dd31c0951a225eaad99eda560e3eb91ba3001dPatch
• https://github.com/metersphere/metersphere/security/advisories/GHSA-88vv-6rm4-59h9Patch, Third Party Advisory
• https://github.com/metersphere/installer/commit/02dd31c0951a225eaad99eda560e3eb91ba3001dPatch
• https://github.com/metersphere/metersphere/security/advisories/GHSA-88vv-6rm4-59h9Patch, Third Party Advisory

Published

Sep 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41872Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-41873Missing Authorization vulnerability in miniOrange SAML SP Si…4.3
• CVE-2023-41874Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-41875Missing Authorization vulnerability in wpdirectorykit.com WP…9.8
• CVE-2023-41876Cross-Site Request Forgery (CSRF) vulnerability in Hardik Ka…8.8
• CVE-2023-41877GeoServer is an open source software server written in Java …7.2
• CVE-2023-41879Magento LTS is the official OpenMage LTS codebase. Guest ord…7.5
• CVE-2023-4188 SQL Injection in GitHub repository instantsoft/icms2 prior …9.1
• CVE-2023-41880Wasmtime is a standalone runtime for WebAssembly. Wasmtime v…5.3
• CVE-2023-41881vantage6 is privacy preserving federated learning infrastruc…4.3
• CVE-2023-41882vantage6 is privacy preserving federated learning infrastruc…4.3
• CVE-2023-41884ZoneMinder is a free, open source Closed-circuit television …6.5