CVE-2024-42323CWE-502

Apache HertzBeat: RCE by snakeYaml deser load malicious xml

High · published September 21, 2024

CVSS v3.1
8.8
EPSS
8%
Percentile
94.9
In the wild
Unconfirmed
What it is

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating).

This vulnerability can only be exploited by authorized attackers.

This issue affects Apache HertzBeat (incubating): before 1.6.0.

Users are recommended to upgrade to version 1.6.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.08322 · 94.9th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2024-09-21T09:30Z
EPSS history
Timeline
  • 21 SEP 09:30Z
    Apache HertzBeat: RCE by snakeYaml deser load malicious xml
    cvelistv5