Vulnerability · Published Dec 22, 2023 · Assigned by GitHub_M
CVE-2022-39337Permission bypass due to incorrect configuration in github.com/dromara/hertzbeat
High 7.5
In plain English
A high-severity improper access control in hertzbeat from dromara. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.1%top 34.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue.
Affected products (as reported)
Weakness: CWE-284, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6 x_refsource_CONFIRM
- https://github.com/dromara/hertzbeat/issues/377 x_refsource_MISC
- https://github.com/dromara/hertzbeat/pull/382 x_refsource_MISC
- https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876 x_refsource_MISC