CVE-2023-51388
CVSS V2 None
CVSS V3 None
Description
Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.
Overview
- CVE ID
- CVE-2023-51388
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-02-22T15:53:46.458Z
- Last Modified Date
- 2024-02-22T15:53:46.458Z
Weakness Enumerations
References
Reference URL | Reference Tags |
---|---|
https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgj | x_refsource_CONFIRM |
https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2 | x_refsource_MISC |
Sources
Source Name | Source URL |
---|---|
NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-51388 |
MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51388 |
History
Created | Old Value | New Value | Data Type | Notes |
---|---|---|---|---|
2024-06-24 19:01:43 | Added to TrackCVE |