CVE-2024-42361

🗓️ 20 Aug 2024 20:56:20Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 76 Views🌐 WEB

Hertzbeat 1.6.0 SQL injection through /api/monitor/{monitorId}/metric/{metricFull} endpoin

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-42361	20 Aug 202423:49	–	circl
CNNVD	Hertzbeat 安全漏洞	20 Aug 202400:00	–	cnnvd
CNVD	Apache Hertzbeat SQL Injection Vulnerability	23 Aug 202400:00	–	cnvd
Cvelist	CVE-2024-42361 GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}	20 Aug 202420:56	–	cvelist
EUVD	EUVD-2024-39570	3 Oct 202520:07	–	euvd
NVD	CVE-2024-42361	20 Aug 202421:15	–	nvd
OSV	CVE-2024-42361 GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}	20 Aug 202420:56	–	osv
Positive Technologies	PT-2024-29896 · Hertzbeat · Hertzbeat	20 Aug 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-42361	5 Feb 202502:25	–	redhatcve
Vulnrichment	CVE-2024-42361 GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}	20 Aug 202420:56	–	vulnrichment

NVD

Vulners

Vulnrichment

Node

apache hertzbeatRange<1.6.0

[
  {
    "vendor": "Apache",
    "product": "HertzBeat",
    "versions": [
      {
        "version": "<= 1.6.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/warehouse/src/main/java/org/dromara/hertzbeat/warehouse/store/HistoryTdEngineDataStorage.java
github	www.github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/warehouse/src/main/java/org/dromara/hertzbeat/warehouse/store/HistoryTdEngineDataStorage.java
github	www.github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/manager/src/main/java/org/dromara/hertzbeat/manager/controller/MonitorsController.java
securitylab	www.securitylab.github.com/advisories/GHSL-2023-254_GHSL-2023-256_HertzBeat/

Parameter	Position	Path	Description	CWE
monitorId	path	/api/monitor/{monitorId}/metric/{metricFull}	SQL injection vulnerability via user-controlled path parameters when composing the query for metrics download.	CWE-89
metricFull	path	/api/monitor/{monitorId}/metric/{metricFull}	SQL injection vulnerability via user-controlled path parameters when composing the query for metrics download.	CWE-89

28 Aug 2024 13:49Current

7.9High risk

Vulners AI Score7.9

CVSS 3.17.5 - 9.8

EPSS0.00322

SSVC

CWE-89