fr Sign in

8.8 High

CVE-2024-42362 Hertzbeat is an open source, real-time monitoring system

Description

Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0.

Affected products and versions

Product	Affected versions	Fixed in
HertzBeat 1.6	earliest → < 1.6.0	1.6.0
hertzbeat 1.6	earliest → < 1.6.0	1.6.0

References

securitylab.github.com securitylab.github.com
github.com github.com
github.com github.com
github.com github.com
github.com github.com
github.com github.com

Timeline

Published August 20, 2024
Last modified August 21, 2024

The 6 CVEs of HertzBeat →

CVE-2024-41151 Deserialization of Untrusted Data vulnerability in Apache HertzBeat Not rated CVE-2024-45791 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat Not rated CVE-2024-45505 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat… Not rated CVE-2024-42323 SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be… Not rated

Track this CVE