CVE-2023-51389

Published: Feb 22, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Hertzbeat is a real-time monitoring system. At the interface of `/define/yml`, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixes this vulnerability.

Affected (1)

Products: Apache: Hertzbeat

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Hertzbeat	Before 1.4.1

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

https://github.com/dromara/hertzbeat/commit/97c3f14446d1c96d1fc993df111684926b6cce17

Source: security-advisories@github.com

Patch

https://github.com/dromara/hertzbeat/security/advisories/GHSA-rmvr-9p5x-mm96

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/dromara/hertzbeat/commit/97c3f14446d1c96d1fc993df111684926b6cce17

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/dromara/hertzbeat/security/advisories/GHSA-rmvr-9p5x-mm96

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

Timeline

No history available yet.