CVE-2025-53639

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-53639

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

M

eterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validated or sanitized. An attacker can supply crafted input to inject and execute arbitrary SQL statements through the sorting functionality. This could result in modification or deletion of database contents, with a potential full compromise of the application’s database integrity and availability. Version 3.6.5-lts fixes the issue.

References
Link Resource
https://github.com/metersphere/metersphere/security/advisories/GHSA-vcm3-5w3f-9f45 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:metersphere:metersphere:*:*:*:*:lts:*:*:*
History

11 Sep 2025, 20:47

Type Values Removed Values Added
First Time Metersphere metersphere
Metersphere
References () https://github.com/metersphere/metersphere/security/advisories/GHSA-vcm3-5w3f-9f45 - () https://github.com/metersphere/metersphere/security/advisories/GHSA-vcm3-5w3f-9f45 - Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:a:metersphere:metersphere:*:*:*:*:lts:*:*:*

15 Jul 2025, 13:14

Type Values Removed Values Added
Summary
  • (es) MeterSphere es una plataforma de pruebas continuas de código abierto. Antes de la versión 3.6.5-lts, el parámetro sortField en ciertos endpoints de la API no se validaba ni depuraba correctamente. Un atacante puede proporcionar una entrada manipulada para inyectar y ejecutar sentencias SQL arbitrarias mediante la función de ordenación. Esto podría provocar la modificación o eliminación del contenido de la base de datos, con la posible vulneración total de la integridad y disponibilidad de la base de datos de la aplicación. La versión 3.6.5-lts corrige este problema.

14 Jul 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-14 20:15

Updated : 2025-09-11 20:47

NVD link : CVE-2025-53639

Mitre link : CVE-2025-53639

CVE.ORG link : CVE-2025-53639

JSON object : View

Products Affected

metersphere

CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')