Lucene search

K
cve[email protected]CVE-2023-51388
HistoryFeb 22, 2024 - 4:15 p.m.

CVE-2023-51388

2024-02-2216:15:53
CWE-74
web.nvd.nist.gov
37
hertzbeat
real-time monitoring
cve-2023-51388
calculatealarm.java
aviatorevaluator
security policy
aviatorscript
script injection
version 1.4.1
vulnerability
nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

Hertzbeat is a real-time monitoring system. In CalculateAlarm.java, AviatorEvaluator is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.

Affected configurations

Vulners
Node
dromarahertzbeatRange<1.4.1
VendorProductVersionCPE
dromarahertzbeat*cpe:2.3:a:dromara:hertzbeat:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "vendor": "dromara",
    "product": "hertzbeat",
    "versions": [
      {
        "version": "< 1.4.1",
        "status": "affected"
      }
    ]
  }
]

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

Related for CVE-2023-51388