Is CVE-2023-32699 actively exploited?

No active exploitation of CVE-2023-32699 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-32699 be exploited remotely?

Yes. CVE-2023-32699 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-32699?

CVE-2023-32699 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2023-32699

MEDIUM

CVE-2023-32699

CWE-770Published: May 30, 2023· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. The `checkUserPassword` method is used to check whether the password provided by the user matches the password saved in the database, and the `CodingUtil.md5` method is used to encrypt the original password with MD5 to ensure that the password will not be saved in plain text when it is stored. If a user submits a very long password when logging in, the system will be forced to execute the long password MD5 encryption process, causing the server CPU and memory to be exhausted, thereby causing a denial of service attack on the server. This issue is fixed in version 2.10.0-lts with a maximum password length.

NVD Source

Technical Analysis

CVE-2023-32699 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 6.5.