CVE-2024-42323 Apache HertzBeat: RCE by snakeYaml deser load malicious xml

2024-09-2109:30:15

CWE-502

apache

github.com

apache hertzbeat

rce

snakeyaml deserialization

cve-2024-42323

malicious xml

authorization

upgrade

AI Score

6.9

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating).

This vulnerability can only be exploited by authorized attackers.
This issue affects Apache HertzBeat (incubating): before 1.6.0.

Users are recommended to upgrade to version 1.6.0, which fixes the issue.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apache:hertzbeat:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apache",
    "product": "hertzbeat",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.6.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]