CVE-2025-48208

Published: Sep 9, 2025Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat . The attacker needs to have an authenticated account with access, and the attack can only be triggered by crafting custom commands. A successful attack would result in arbitrary script execution. This issue affects Apache HertzBeat: through 1.7.2. Users are recommended to upgrade to version [1.7.3], which fixes the issue.

Affected (1)

Products: Apache: Hertzbeat

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Hertzbeat	Before 1.7.3

Related CWEs

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

References (2)

https://lists.apache.org/thread/3zrr3oo67pxxx7wgzj80kglltfshngn2

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2025/09/06/5

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.