CVE-2022-39337
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| dromara | hertzbeat | <= 1.2.0 | affected |
Weaknesses
- CWE-284: CWE-284: Improper Access Control
- CWE-863: CWE-863: Incorrect Authorization
ADP Enrichment
CVE Program Container
Additional References
- https://github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6
- https://github.com/dromara/hertzbeat/issues/377
- https://github.com/dromara/hertzbeat/pull/382
- https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876
References
- https://github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6
- https://github.com/dromara/hertzbeat/issues/377
- https://github.com/dromara/hertzbeat/pull/382
- https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.