CVE-2023-51389

Summary

Hertzbeat is a real-time monitoring system. At the interface of /define/yml, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixes this vulnerability.

Affected Software

Weaknesses

• CWE-502: CWE-502: Deserialization of Untrusted Data

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/dromara/hertzbeat/security/advisories/GHSA-rmvr-9p5x-mm96
• https://github.com/dromara/hertzbeat/commit/97c3f14446d1c96d1fc993df111684926b6cce17

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/dromara/hertzbeat/security/advisories/GHSA-rmvr-9p5x-mm96
• https://github.com/dromara/hertzbeat/commit/97c3f14446d1c96d1fc993df111684926b6cce17

• ←Previous
• Next→