Lucene search

K
cvelistGitHub_MCVELIST:CVE-2023-51388
HistoryFeb 22, 2024 - 3:53 p.m.

CVE-2023-51388 HertzBeat AviatorScript Inject RCE

2024-02-2215:53:46
CWE-74
GitHub_M
www.cve.org
2
hertzbeat
aviatorscript
injection

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

10

Confidence

High

EPSS

0

Percentile

9.0%

Hertzbeat is a real-time monitoring system. In CalculateAlarm.java, AviatorEvaluator is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.

CNA Affected

[
  {
    "vendor": "dromara",
    "product": "hertzbeat",
    "versions": [
      {
        "version": "< 1.4.1",
        "status": "affected"
      }
    ]
  }
]

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

10

Confidence

High

EPSS

0

Percentile

9.0%

Related for CVELIST:CVE-2023-51388