PT-2023-13720 · Hertzbeat · Hertzbeat

2Xiaodi · Published 2023-12-22 · Updated 2024-08-28 · CVE-2022-39337

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hertzbeat versions 1.20 and prior

Description Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless capabilities. The system has a permission bypass issue, allowing system authentication to be bypassed and interfaces to be invoked without authorization.

Recommendations For Hertzbeat versions 1.20 and prior, update to version 1.2.1 or later, which contains a patch for this issue. As a temporary workaround, consider restricting access to sensitive interfaces until the patch can be applied.

Exploit

Fix

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

CVE-2022-39337

GHSA-434F-F5CW-3RJ6

Affected Products

Hertzbeat

References · 9

• 🔥 https://github.com/dromara/hertzbeat/issues/377 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39337.json · Exploit
• https://github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6 · Vendor Advisory
• https://github.com/dromara/hertzbeat/pull/382 · Patch
• https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876 · Patch
• https://osv.dev/vulnerability/CVE-2022-39337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39337 · Security Note
• https://t.me/cvenotify/92508 · Telegram Post
• https://twitter.com/cracbot/status/1738624107200090522 · Twitter Post