PT-2023-31868 · Hertzbeat · Hertzbeat

Pbuff07 · Published 2023-12-22 · Updated 2024-08-28 · CVE-2023-51650

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hertzbeat versions prior to 1.4.1

Description Hertzbeat is an open source, real-time monitoring system. Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces, potentially resulting in the disclosure of sensitive server information.

Recommendations For versions prior to 1.4.1, update to version 1.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable interfaces until the update can be applied.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-51650

GHSA-RRC5-QPXR-5JM2

Affected Products

Hertzbeat

References · 9

• 🔥 https://github.com/dromara/hertzbeat/security/advisories/GHSA-rrc5-qpxr-5jm2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51650.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-51650 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51650 · Security Note
• https://github.com/dromara/hertzbeat/releases/tag/v1.4.1 · Note
• https://t.me/cvenotify/66106 · Telegram Post
• https://t.me/cvenotify/92510 · Telegram Post
• https://twitter.com/cracbot/status/1738624161386213641 · Twitter Post
• https://twitter.com/CVEnew/status/1738306729316630697 · Twitter Post