CVE-2025-62604

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-62604
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62604.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-62604
Aliases
  • GHSA-vj5x-7374-rf96
Published
2025-10-22T15:03:40.178Z
Modified
2026-07-15T15:53:40.672437Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L CVSS Calculator
Summary
MeterSphere logic flaw allows retrieval of arbitrary user information
Details

MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allows an unauthenticated attacker to log in to the system as any user. This issue has been patched in version 2.10.25-lts.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62604.json"
}
References

Affected packages

Git / github.com/metersphere/metersphere

Affected ranges

Type
GIT
Repo
https://github.com/metersphere/metersphere
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e7e1b1f729b7338be804c565b2bf47bb812e2579
Fixed
b984fe74e84711ff326b0a348807c31fadf134af
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:metersphere:metersphere:*:*:*:*:lts:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.10.25"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.2.0
v2.*
v2.10.0-lts
v2.10.1-lts
v2.10.10-lts
v2.10.11-lts
v2.10.12-lts
v2.10.13-lts
v2.10.14-lts
v2.10.15-lts
v2.10.16-lts
v2.10.17-lts
v2.10.18-lts
v2.10.2-lts
v2.10.20-lts
v2.10.21-lts
v2.10.22-lts
v2.10.23-lts
v2.10.24-lts
v2.10.3-lts
v2.10.4-lts
v2.10.5-lts
v2.10.6-lts
v2.10.7-lts
v2.10.8-lts
v2.10.9-lts

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62604.json"
vanir_signatures 
[
    {
        "id": "CVE-2025-62604-2bce1db3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af",
        "deprecated": false,
        "digest": {
            "function_hash": "167529578135013148571874925145828919394",
            "length": 647.0
        },
        "target": {
            "function": "login",
            "file": "framework/gateway/src/main/java/io/metersphere/gateway/service/UserLoginService.java"
        }
    },
    {
        "id": "CVE-2025-62604-3c033522",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "205463448874440740733261835163674580077",
                "90011029780417313854439852521127420109",
                "311128020071034470894714749005539800619",
                "121613911504061536728405670610111544599",
                "94818384781434871809852542524986985865",
                "291141120781731669685638456377973358057",
                "2777977501814966475649797664094955405",
                "208136347484718421799191191176553003056",
                "302553837732234540134210950576580294123",
                "239310460682496309911369796423533261861",
                "79145367171885141987106650983522541705",
                "149482706023547121651026317217257303092"
            ]
        },
        "target": {
            "file": "framework/gateway/src/main/java/io/metersphere/gateway/service/LdapService.java"
        }
    },
    {
        "id": "CVE-2025-62604-a881843e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "280728831076523891551009434576273609139",
                "72449540274525829690800178184565914997",
                "266179787660360695232813701138381259541",
                "282941873903395824098927881318111282493",
                "323268916987657919306953132779211054332",
                "119603106056652980836448346120730560793",
                "32333230834769989594778708767232582123",
                "226323339098148282688001222304451892991"
            ]
        },
        "target": {
            "file": "framework/gateway/src/main/java/io/metersphere/gateway/controller/LoginController.java"
        }
    },
    {
        "id": "CVE-2025-62604-ac3d3b85",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af",
        "deprecated": false,
        "digest": {
            "function_hash": "238861167805664696984257023168606198424",
            "length": 501.0
        },
        "target": {
            "function": "login",
            "file": "framework/gateway/src/main/java/io/metersphere/gateway/controller/LoginController.java"
        }
    },
    {
        "id": "CVE-2025-62604-c3b82cae",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "14502820352165947312773343659833905401",
                "73941426355312884792835818516843048183",
                "77394726349146022433331713930570475084",
                "176246879468406073703138889928555541446",
                "18514357516965830323599941915773304376",
                "269938398795987449139912353173397378834",
                "23919777596334911910933408299998414822",
                "237821268928337252751917574090177336599",
                "109463833794061650530463448002180503820",
                "292771478550178101954053280963973262124",
                "9617436752511325268656925048601639124",
                "173320717222577667302512134448364844372",
                "252029930630547892880000749568184533792",
                "32976321394995012428328546682520524500",
                "154529013713696312308001696817385494375",
                "297595436205674328756338443204560149983",
                "208396041264163570582677219803298150379",
                "253329029641704563828264990245401081235",
                "247306570060294758594972306376900682247",
                "66784716827959858906885292919411263549",
                "146456875650098497589785525850450130226",
                "178739140633001532744318043663852234092",
                "112480518197992235869135243487023939233",
                "245659754430397603602895420059021827665",
                "288294271938406210603318015190791565424",
                "221239640949427329055890039461635371862",
                "314880458137263727243153985637190319819",
                "29664788539303999497063078522415269049",
                "87154588449580699847911230113558833102",
                "145648349779519165752695414671214762980",
                "315654302625174613739367301575871908941",
                "169775519793505221117027937493377240631",
                "303765376614537596499777811243540498765",
                "23815893732385087761122593865269790505",
                "144652230718074889633693482145583605168",
                "212486195873459066391626570284458252144",
                "47306536902524277889807436181292670435",
                "251739939126809229052811752029539298406",
                "302016832645427357716875929316897625204",
                "297338400711049676067100816395585245085",
                "101014025618894918484233941921977024828",
                "79876131419348352444625031846973686176",
                "186388162222193491166877518638144052910",
                "238475172037643412627426364508939989149",
                "278198770334861326909881299979357961177",
                "21387465322578157462718258593993652580",
                "61014703836698859238504668805228574776",
                "126808133708607739484769797374402515840",
                "299353750670064467668180296295431033219",
                "117182613882299544354093991031341146122",
                "332407877251398086501124643948796683602",
                "188529755002953028631837899842778300640",
                "120140157219825838425819047749686562267",
                "273586749250658280428884884296808379393",
                "52665930225374795458123032870513545560",
                "29809942627665105552377564304162235368",
                "4657763068602379573434860764583080209",
                "126792368077165196329384721340138935782",
                "81124325231560982986146394274245460473",
                "244993683949900391424345411126804559462",
                "207066640901785561647592580471300579923",
                "50689827039750589010306236169478328233",
                "228443201576173991322646809652099772012"
            ]
        },
        "target": {
            "file": "framework/gateway/src/main/java/io/metersphere/gateway/service/UserLoginService.java"
        }
    }
]
vanir_signatures_modified 
"2026-07-15T15:53:40Z"