Lucene search

GitHub_MCVELIST:CVE-2022-39337

HistoryDec 22, 2023 - 3:06 p.m.

CVE-2022-39337 Permission bypass due to incorrect configuration in github.com/dromara/hertzbeat

2023-12-2215:06:04

CWE-284

CWE-863

GitHub_M

www.cve.org

cve-2022-39337

permission bypass

incorrect configuration

hertzbeat

github

real-time monitoring

prometheus-like

authentication bypass

authorization

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

22.7%

JSON

Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue.

CNA Affected

[
  {
    "vendor": "dromara",
    "product": "hertzbeat",
    "versions": [
      {
        "version": "<= 1.2.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876

github.com/dromara/hertzbeat/issues/377

github.com/dromara/hertzbeat/pull/382

github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

22.7%

JSON

Related for CVELIST:CVE-2022-39337