CVE-2023-51389

EUVD-2023-56110 · Published Feb 22, 2024

Hertzbeat is a real-time monitoring system. At the interface of /define/yml, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixes this vulnerability.

Technologies

Apache Hertzbeat

Weaknesses

CWE-502

CVSS scores

v3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://github.com/dromara/hertzbeat/security/advisories/GHSA-rmvr-9p5x-mm96
https://github.com/dromara/hertzbeat/commit/97c3f14446d1c96d1fc993df111684926b6cce17

Potentially impacted assets

See if this affects your attack surface