Design/Logic Flaw

2024-02-2216:15:00

PRIOn knowledge base

www.prio-n.com

design flaw

logic flaw

hertzbeat

real-time monitoring

calculatealarm vulnerability

aviatorevaluator

security policy

script injection

aviatorscript

version 1.4.1

7.8 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Hertzbeat is a real-time monitoring system. In CalculateAlarm.java, AviatorEvaluator is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.