Unrated severityNVD Advisory· Published Feb 22, 2024· Updated Aug 14, 2024
HertzBeat AviatorScript Inject RCE
CVE-2023-51388
Description
Hertzbeat is a real-time monitoring system. In CalculateAlarm.java, AviatorEvaluator is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.
Affected products
2- dromara/hertzbeatv5Range: < 1.4.1
Patches
Vulnerability mechanics
References
2- github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2mitrex_refsource_MISC
- github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgjmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.