« Volver al listado

CVE-2023-25822

Estado: ModificadaMedia (6.5)—

ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the `com.epam.reportportal:service-api` module, corresponding to ReportPortal version 23.2, the ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1 test inside when the test_item.path field is exceeded the allowable `ltree` field type indexing limit (path length>=120, approximately recursive nesting of the nested steps). REINDEX INDEX path_gist_idx and path_idx aren't helped.

Leer descripción completaMostrar menos

The problem was fixed in `com.epam.reportportal:service-api` module version 5.10.0 (product release 23.2), where the maximum number of nested elements were programmatically limited. A workaround is available. After deletion of the data with long paths, and reindexing both indexes (path_gist_idx and path_idx), the database becomes stable and ReportPortal works properly.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Reportportal — ReportportalReportportal — Service-api

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-25822",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-25822",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-19T13:15:21.478701Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "reportportal",
          "product": "reportportal",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.10.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-10-09T14:15:10.547",
  "references": [
    {
      "url": "https://github.com/reportportal/reportportal/releases/tag/v23.2",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/reportportal/reportportal/security/advisories/GHSA-mj24-gpw7-23m9",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://reportportal.io/docs/releases/Version23.2/",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/reportportal/reportportal/releases/tag/v23.2",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/reportportal/reportportal/security/advisories/GHSA-mj24-gpw7-23m9",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://reportportal.io/docs/releases/Version23.2/",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the `com.epam.reportportal:service-api` module, corresponding to ReportPortal version 23.2, the ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1 test inside when the test_item.path field is exceeded the allowable `ltree` field type indexing limit (path length>=120, approximately recursive nesting of the nested steps). REINDEX INDEX path_gist_idx and path_idx aren't helped. The problem was fixed in `com.epam.reportportal:service-api` module version 5.10.0 (product release 23.2), where the maximum number of nested elements were programmatically limited. A workaround is available. After deletion of the data with long paths, and reindexing both indexes (path_gist_idx and path_idx), the database becomes stable and ReportPortal works properly."
    },
    {
      "lang": "es",
      "value": "ReportPortal es una plataforma de automatización de pruebas impulsada por IA. Antes de la versión 5.10.0 del módulo `com.epam.reportportal:service-api`, correspondiente a la versión 23.2 de ReportPortal, la base de datos de ReportPortal se vuelve inestable y los informes se detienen casi por completo, excepto en pequeños inicios con aproximadamente 1 prueba interna cuando se ejecuta test_item. El campo de ruta ha excedido el límite de indexación de tipo de campo `ltree` permitido (path length&gt;=120, anidamiento aproximadamente recursivo de los pasos anidados). REINDEX INDEX path_gist_idx y path_idx no reciben ayuda. El problema se solucionó en la versión 5.10.0 del módulo `com.epam.reportportal:service-api` (versión 23.2 del producto), donde el número máximo de elementos anidados estaba limitado mediante programación. Hay un workaround disponible. Después de eliminar los datos con rutas largas y reindexar ambos índices (path_gist_idx y path_idx), la base de datos se estabiliza y ReportPortal funciona correctamente."
    }
  ],
  "lastModified": "2026-06-17T05:42:03.723",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:reportportal:reportportal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA457CC7-2162-45F4-9242-627E4834CB40",
              "versionEndExcluding": "23.2"
            },
            {
              "criteria": "cpe:2.3:a:reportportal:service-api:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F2404BAD-E6F4-4CC7-BCD6-4F9FB004CA68",
              "versionEndExcluding": "5.10.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}