{"id":"CVE-2025-62604","summary":"MeterSphere logic flaw allows retrieval of arbitrary user information","details":"MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allows an unauthenticated attacker to log in to the system as any user. This issue has been patched in version 2.10.25-lts.","aliases":["GHSA-vj5x-7374-rf96"],"modified":"2026-08-12T15:14:26.062051Z","published":"2025-10-22T15:03:40.178Z","database_specific":{"cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62604.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/metersphere/metersphere/releases/tag/v2.10.25-lts"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62604.json"},{"type":"ADVISORY","url":"https://github.com/metersphere/metersphere/security/advisories/GHSA-vj5x-7374-rf96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62604"},{"type":"FIX","url":"https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/metersphere/metersphere","events":[{"introduced":"0"},{"fixed":"e7e1b1f729b7338be804c565b2bf47bb812e2579"},{"fixed":"b984fe74e84711ff326b0a348807c31fadf134af"}],"database_specific":{"cpe":"cpe:2.3:a:metersphere:metersphere:*:*:*:*:lts:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.10.25"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v2.10.24-lts","v2.10.23-lts","v2.10.22-lts","v2.10.21-lts","v2.10.20-lts","v2.10.18-lts","v2.10.17-lts","v2.10.16-lts","v2.10.15-lts","v2.10.14-lts","v2.10.13-lts","v2.10.12-lts","v2.10.11-lts","v2.10.10-lts","v2.10.9-lts","v2.10.8-lts","v2.10.7-lts","v2.10.6-lts","v2.10.5-lts","v2.10.4-lts","v2.10.3-lts","v2.10.2-lts","v2.10.1-lts","v2.10.0-lts","v1.2.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62604.json","vanir_signatures_modified":"2026-08-12T15:14:26Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af","target":{"file":"framework/gateway/src/main/java/io/metersphere/gateway/service/UserLoginService.java","function":"login"},"deprecated":false,"digest":{"function_hash":"167529578135013148571874925145828919394","length":647},"id":"CVE-2025-62604-2bce1db3"},{"digest":{"line_hashes":["205463448874440740733261835163674580077","90011029780417313854439852521127420109","311128020071034470894714749005539800619","121613911504061536728405670610111544599","94818384781434871809852542524986985865","291141120781731669685638456377973358057","2777977501814966475649797664094955405","208136347484718421799191191176553003056","302553837732234540134210950576580294123","239310460682496309911369796423533261861","79145367171885141987106650983522541705","149482706023547121651026317217257303092"],"threshold":0.9},"id":"CVE-2025-62604-3c033522","signature_type":"Line","signature_version":"v1","source":"https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af","target":{"file":"framework/gateway/src/main/java/io/metersphere/gateway/service/LdapService.java"},"deprecated":false},{"source":"https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af","target":{"file":"framework/gateway/src/main/java/io/metersphere/gateway/controller/LoginController.java"},"deprecated":false,"digest":{"line_hashes":["280728831076523891551009434576273609139","72449540274525829690800178184565914997","266179787660360695232813701138381259541","282941873903395824098927881318111282493","323268916987657919306953132779211054332","119603106056652980836448346120730560793","32333230834769989594778708767232582123","226323339098148282688001222304451892991"],"threshold":0.9},"id":"CVE-2025-62604-a881843e","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af","target":{"file":"framework/gateway/src/main/java/io/metersphere/gateway/controller/LoginController.java","function":"login"},"deprecated":false,"digest":{"function_hash":"238861167805664696984257023168606198424","length":501},"id":"CVE-2025-62604-ac3d3b85"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af","target":{"file":"framework/gateway/src/main/java/io/metersphere/gateway/service/UserLoginService.java"},"deprecated":false,"digest":{"line_hashes":["14502820352165947312773343659833905401","73941426355312884792835818516843048183","77394726349146022433331713930570475084","176246879468406073703138889928555541446","18514357516965830323599941915773304376","269938398795987449139912353173397378834","23919777596334911910933408299998414822","237821268928337252751917574090177336599","109463833794061650530463448002180503820","292771478550178101954053280963973262124","9617436752511325268656925048601639124","173320717222577667302512134448364844372","252029930630547892880000749568184533792","32976321394995012428328546682520524500","154529013713696312308001696817385494375","297595436205674328756338443204560149983","208396041264163570582677219803298150379","253329029641704563828264990245401081235","247306570060294758594972306376900682247","66784716827959858906885292919411263549","146456875650098497589785525850450130226","178739140633001532744318043663852234092","112480518197992235869135243487023939233","245659754430397603602895420059021827665","288294271938406210603318015190791565424","221239640949427329055890039461635371862","314880458137263727243153985637190319819","29664788539303999497063078522415269049","87154588449580699847911230113558833102","145648349779519165752695414671214762980","315654302625174613739367301575871908941","169775519793505221117027937493377240631","303765376614537596499777811243540498765","23815893732385087761122593865269790505","144652230718074889633693482145583605168","212486195873459066391626570284458252144","47306536902524277889807436181292670435","251739939126809229052811752029539298406","302016832645427357716875929316897625204","297338400711049676067100816395585245085","101014025618894918484233941921977024828","79876131419348352444625031846973686176","186388162222193491166877518638144052910","238475172037643412627426364508939989149","278198770334861326909881299979357961177","21387465322578157462718258593993652580","61014703836698859238504668805228574776","126808133708607739484769797374402515840","299353750670064467668180296295431033219","117182613882299544354093991031341146122","332407877251398086501124643948796683602","188529755002953028631837899842778300640","120140157219825838425819047749686562267","273586749250658280428884884296808379393","52665930225374795458123032870513545560","29809942627665105552377564304162235368","4657763068602379573434860764583080209","126792368077165196329384721340138935782","81124325231560982986146394274245460473","244993683949900391424345411126804559462","207066640901785561647592580471300579923","50689827039750589010306236169478328233","228443201576173991322646809652099772012"],"threshold":0.9},"id":"CVE-2025-62604-c3b82cae"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L"}]}