CVE-2024-42323 Apache HertzBeat: RCE by snakeYaml deser load malicious xml

2024-09-2109:30:15

CWE-502

apache

www.cve.org

cve-2024-42323

rce

snakeyaml

malicious xml

apache hertzbeat

EPSS

Percentile

9.6%

JSON

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating).

This vulnerability can only be exploited by authorized attackers.
This issue affects Apache HertzBeat (incubating): before 1.6.0.

Users are recommended to upgrade to version 1.6.0, which fixes the issue.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache HertzBeat",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "1.6.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]