PT-2024-29872 · Apache · Apache Hertzbeat

Liufeng Yi + 1 · CVE-2024-42323 · Published 2024-09-21 · Updated 2026-01-04

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache HertzBeat (incubating) versions prior to 1.6.0

Description The software is susceptible to a remote code execution issue stemming from a malicious XML deserialization flaw within the SnakeYaml component. This issue can only be exploited by authorized attackers.

Recommendations Upgrade to version 1.6.0 to resolve the issue.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-42323

Affected Products

Apache Hertzbeat

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42323.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-42323 · Vendor Advisory
• https://lists.apache.org/thread/r0c4tost4bllqc1n9q6rmzs1slgsq63t · Vendor Advisory
• https://lists.apache.org/thread/dwpwm572sbwon1mknlwhkpbom2y7skbx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42323 · Security Note
• https://twitter.com/oss_security/status/1837450883329585213 · Twitter Post
• https://t.me/cvenotify/95577 · Telegram Post
• https://twitter.com/r0otk3r/status/2007623796430405975 · Twitter Post
• https://t.me/cvenotify/127311 · Telegram Post
• http://openwall.com/lists/oss-security/2024/09/21/1 · Note
• https://t.me/cvedetector/6141 · Telegram Post
• https://twitter.com/cracbot/status/1838820811693789441 · Twitter Post
• https://twitter.com/cracbot/status/1839183166151733354 · Twitter Post
• https://twitter.com/oktsec/status/1837410840292565161 · Twitter Post
• https://twitter.com/cracbot/status/1838458459010011635 · Twitter Post