High severity8.8NVD Advisory· Published Aug 20, 2024· Updated Jun 17, 2026

CVE-2024-42362

Description

Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/HertzBeat3 versions
cpe:2.3:a:apache:hertzbeat:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:apache:hertzbeat:*:*:*:*:*:*:*:*range: <1.6.0
- (no CPE)range: <1.6.0
- (no CPE)range: < 1.6.0

Patches

Vulnerability mechanics

References

github.com/apache/hertzbeat/commit/79f5408e345e8e89da97be05f43e3204a950ddfbnvdPatch
github.com/apache/hertzbeat/commit/9dbbfb7812fc4440ba72bdee66799edd519d06bbnvdPatch
github.com/apache/hertzbeat/pull/1611nvdPatch
github.com/apache/hertzbeat/pull/1620nvdPatch
github.com/apache/hertzbeat/pull/1620/filesnvdPatch
securitylab.github.com/advisories/GHSL-2023-254_GHSL-2023-256_HertzBeat/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000