CVE-2024-41151CWE-502

Apache HertzBeat: RCE by notice template injection vulnerability

High · published November 18, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
62.0
In the wild
Unconfirmed
What it is

Deserialization of Untrusted Data vulnerability in Apache HertzBeat.

This vulnerability can only be exploited by authorized attackers.

This issue affects Apache HertzBeat: before 1.6.1.

Users are recommended to upgrade to version 1.6.1, which fixes the issue.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00983 · 62.0th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2024-11-18T08:45Z
EPSS history
Timeline
  • 18 NOV 08:45Z
    Apache HertzBeat: RCE by notice template injection vulnerability
    cvelistv5