CVE-2023-25573
CVSS v3
7.5
HIGH
EPSS Score
51.6 %
exploit probability, as of 2026-10-05
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Technical details
- Published
- 2023-03-09
Frequently asked questions
What is CVE-2023-25573?
metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Is CVE-2023-25573 actively exploited?
Active exploitation of CVE-2023-25573 has not been confirmed. Its EPSS score was 51.6% on 2026-10-05, the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2023-25573?
CVE-2023-25573 has a CVSS v3 base score of 7.5 (HIGH severity).
Is CVE-2023-25573 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 50 free checks/month · Free API key
Other 2023 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).