PT-2025-36720 · Apache · Apache Hertzbeat

Aftersnow + 1 · Published 2025-09-09 · Updated 2025-09-17 · CVE-2025-48208

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache HertzBeat versions through 1.7.2

Description: This issue involves an improper neutralization of special elements used in an LDAP query, specifically an LDAP injection flaw, in Apache HertzBeat. An attacker requires an authenticated account with access to trigger the issue by crafting custom commands. A successful attack could lead to arbitrary script execution.

Recommendations: Upgrade to version 1.7.3 to resolve the issue.

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2025-48208

Affected Products

Apache Hertzbeat

References · 8

• https://lists.apache.org/thread/3zrr3oo67pxxx7wgzj80kglltfshngn2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48208 · Security Note
• https://t.me/cveNotify/134744 · Telegram Post
• http://openwall.com/lists/oss-security/2025/09/06/5 · Note
• https://twitter.com/CVEnew/status/1965349758324637866 · Twitter Post
• https://twitter.com/oss_security/status/1968112058781880382 · Twitter Post
• https://t.me/CVEtracker/32067 · Telegram Post