CVE-2024-42323

nvd nist nuclei

Published: Sep 21, 2024Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.0. Users are recommended to upgrade to version 1.6.0, which fixes the issue.

Affected (1)

Products: Apache: Hertzbeat

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Hertzbeat	Before 1.6.0

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

https://lists.apache.org/thread/dwpwm572sbwon1mknlwhkpbom2y7skbx

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread/r0c4tost4bllqc1n9q6rmzs1slgsq63t

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2024/09/21/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

Timeline

No history available yet.