VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Feb 22, 2024· Updated Jun 17, 2026

CVE-2023-51388

CVE-2023-51388

Description

Hertzbeat is a real-time monitoring system. In CalculateAlarm.java, AviatorEvaluator is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.

Affected products

3
  • Apache/HertzBeat
    cpe:2.3:a:apache:hertzbeat:*:*:*:*:*:*:*:*
    Range: <1.4.1
  • Dromara/hertzbeatllm-fuzzy2 versions
    <1.4.1+ 1 more
    • (no CPE)range: <1.4.1
    • (no CPE)range: < 1.4.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.