PT-2024-29872 · Apache · Apache Hertzbeat

Liufeng Yi + 1 · Published 2024-09-21 · Updated 2026-01-04 · CVE-2024-42323

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache HertzBeat (incubating) versions prior to 1.6.0

Description The software is susceptible to a remote code execution issue stemming from a malicious XML deserialization flaw within the SnakeYaml component. This issue can only be exploited by authorized attackers.

Recommendations Upgrade to version 1.6.0 to resolve the issue.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-42323

Affected Products

Apache Hertzbeat

References · 16

• https://osv.dev/vulnerability/CVE-2024-42323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42323 · Security Note
• https://lists.apache.org/thread/dwpwm572sbwon1mknlwhkpbom2y7skbx · Vendor Advisory
• https://lists.apache.org/thread/r0c4tost4bllqc1n9q6rmzs1slgsq63t · Vendor Advisory
• https://t.me/cvenotify/127311 · Telegram Post
• https://twitter.com/oss_security/status/1837450883329585213 · Twitter Post
• https://twitter.com/CVEnew/status/1837426213196849296 · Twitter Post
• https://twitter.com/oktsec/status/1837410840292565161 · Twitter Post
• https://twitter.com/cracbot/status/1838458459010011635 · Twitter Post
• https://twitter.com/cracbot/status/1839183166151733354 · Twitter Post
• https://t.me/cvedetector/6141 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1837456778985963986 · Twitter Post
• http://openwall.com/lists/oss-security/2024/09/21/1 · Note
• https://t.me/cvenotify/95577 · Telegram Post
• https://twitter.com/r0otk3r/status/2007623796430405975 · Twitter Post