PT-2023-13720 · Hertzbeat · Hertzbeat

2Xiaodi · Publicado 2023-12-22 · Atualizado 2024-08-28 · CVE-2022-39337

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hertzbeat versions 1.20 and prior

Description Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless capabilities. The system has a permission bypass issue, allowing system authentication to be bypassed and interfaces to be invoked without authorization.

Recommendations For Hertzbeat versions 1.20 and prior, update to version 1.2.1 or later, which contains a patch for this issue. As a temporary workaround, consider restricting access to sensitive interfaces until the patch can be applied.

Exploit

Correção

Incorrect Authorization

Improper Access Control

Enumeração de Fraquezas

CWE-863

CWE-284

Identificadores relacionados

CVE-2022-39337

GHSA-434F-F5CW-3RJ6

Produtos afetados

Hertzbeat

Referências · 9

• 🔥 https://github.com/dromara/hertzbeat/issues/377 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39337.json · Exploit
• https://github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6 · Aviso do Fabricante
• https://github.com/dromara/hertzbeat/pull/382 · Correção
• https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876 · Correção
• https://osv.dev/vulnerability/CVE-2022-39337 · Aviso do Fabricante
• https://t.me/cvenotify/92508 · Publicação no Telegram
• https://twitter.com/cracbot/status/1738624107200090522 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2022-39337 · Nota de Segurança