PT-2024-14104 · Snakeyaml+1 · Snakeyaml+1

Luelueking · Published 2024-02-22 · Updated 2025-01-16 · CVE-2023-51389

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hertzbeat versions prior to 1.4.1

Description Hertzbeat is a real-time monitoring system. At the interface of "/define/yml", SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability.

Recommendations For versions prior to 1.4.1, update to version 1.4.1 to fix the vulnerability. As a temporary workaround, consider restricting access to the "/define/yml" interface until the update is applied.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-51389

GHSA-RMVR-9P5X-MM96

Affected Products

Hertzbeat

Snakeyaml

References · 9

• 🔥 https://github.com/dromara/hertzbeat/security/advisories/GHSA-rmvr-9p5x-mm96 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51389.json · Exploit
• https://github.com/dromara/hertzbeat/commit/97c3f14446d1c96d1fc993df111684926b6cce17 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-51389 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51389 · Vendor Advisory
• https://twitter.com/cracbot/status/1760907396652859527 · Twitter Post
• https://twitter.com/CVEnew/status/1760706490334367814 · Twitter Post
• https://t.me/cvenotify/72224 · Telegram Post
• https://t.me/cvenotify/107675 · Telegram Post