High severity · published Dec 22, 2023
CVE-2023-51650
Unauthorized access vulnerability on three interfaces
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
hertzbeat · dromara
< 1.4.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-51650
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-51650
Release Notes
https://github.com/dromara/hertzbeat/releases/tag/v1.4.1
Exploit
https://github.com/dromara/hertzbeat/security/advisories/GHSA-rrc5-qpxr-5jm2
More from hertzbeat
9.8
CVE-2023-51389
HertzBeat SnakeYAML Deser RCE
9.8
CVE-2023-51388
HertzBeat AviatorScript Inject RCE
9.8
CVE-2023-51653
Hertzbeat JMX JNDI RCE
8.8
CVE-2024-42362
GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import
8.8
CVE-2023-51387
Expression Injection Vulnerability in Hertzbeat