Vulnerability Description
Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Hertzbeat | < 1.4.1 |
Related Weaknesses (CWE)
References
- https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1Patch
- https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgjExploitVendor Advisory
- https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1Patch
- https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgjExploitVendor Advisory
FAQ
What is CVE-2023-51388?
CVE-2023-51388 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in Aviator...
How severe is CVE-2023-51388?
CVE-2023-51388 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-51388?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Hertzbeat.