PT-2023-31868 · Hertzbeat · Hertzbeat

Pbuff07 · Publicado 2023-12-22 · Atualizado 2024-08-28 · CVE-2023-51650

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hertzbeat versions prior to 1.4.1

Description Hertzbeat is an open source, real-time monitoring system. Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces, potentially resulting in the disclosure of sensitive server information.

Recommendations For versions prior to 1.4.1, update to version 1.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable interfaces until the update can be applied.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-51650

GHSA-RRC5-QPXR-5JM2

Produtos afetados

Hertzbeat

Referências · 9

• 🔥 https://github.com/dromara/hertzbeat/security/advisories/GHSA-rrc5-qpxr-5jm2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51650.json · Exploit
• https://github.com/dromara/hertzbeat/releases/tag/v1.4.1 · Nota
• https://osv.dev/vulnerability/CVE-2023-51650 · Aviso do Fabricante
• https://t.me/cvenotify/66106 · Publicação no Telegram
• https://t.me/cvenotify/92510 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-51650 · Nota de Segurança
• https://twitter.com/cracbot/status/1738624161386213641 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1738306729316630697 · Publicação no Twitter