9.8
Critical
CVE-2023-51388 Hertzbeat is a real-time monitoring system
Description
Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| hertzbeat 1.4 | earliest → < 1.4.1 | 1.4.1 |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of hertzbeat
The 7 CVEs of hertzbeat →
CVE-2024-42362
Hertzbeat is an open source, real-time monitoring system
8.8
High
CVE-2023-51389
Hertzbeat is a real-time monitoring system
9.8
Critical
CVE-2023-51653
Hertzbeat is a real-time monitoring system
9.8
Critical
CVE-2023-51650
Hertzbeat is an open source, real-time monitoring system
7.5
High