CVE-2023-51389: apache hertzbeat Deserialization of Untrusted Data

Vulnerability summary

CVE-2023-51389 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in apache hertzbeat. EPSS estimates a 1.28% chance of exploitation in the next 30 days, higher than 69.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-02-2024
   PublishedVulnerability first disclosed.
2. 22-08-2024
   Last modifiedVulnerability information updated.

Description

Hertzbeat is a real-time monitoring system. At the interface of `/define/yml`, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixes this vulnerability.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.