CVE-2024-41151: high-severity vulnerability in Apache HertzBeat
Apache HertzBeat: RCE by notice template injection vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 1.0%
Deserialization of Untrusted Data vulnerability in Apache HertzBeat.
This vulnerability can only be exploited by authorized attackers.
This issue affects Apache HertzBeat: before 1.6.1.
Users are recommended to upgrade to version 1.6.1, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache HertzBeatRelated CVEs — Apache HertzBeat
In the same product, most dangerous first.
CVE-2024-42323HIGHApache HertzBeat: RCE by snakeYaml deser load malicious xmlEPSS 8.3%CVE-2024-45505HIGHApache HertzBeat: Exists Native Deser RCE and file writing vulnerabilitiesEPSS 2.2%CVE-2024-45791HIGHApache HertzBeat: Exposure sensitive token via http GET method with query stringEPSS 0.8%CVE-2026-24343HIGHApache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath ExpressionsEPSS 0.8%CVE-2024-56736MEDIUMApache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config OssEPSS 0.7%CVE-2026-114442—Apache HertzBeat: incomplete XPath expression validation in aliasFieldsEPSS 0.2%