Vulnerability · Published Dec 22, 2023 · Assigned by GitHub_M
CVE-2023-51650Unauthorized access vulnerability on three interfaces
High 7.5
In plain English
A high-severity missing authorization in hertzbeat from dromara. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 41.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/dromara/hertzbeat/security/advisories/GHSA-rrc5-qpxr-5jm2 x_refsource_CONFIRM
- https://github.com/dromara/hertzbeat/releases/tag/v1.4.1 x_refsource_MISC