Apache HertzBeat: RCE by snakeYaml deser load malicious xml
36Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 8.8epss 8.3%
exploitation probability
8.3%top 5% of all CVEs
observed exploitation
nono source reports it
SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating).
This vulnerability can only be exploited by authorized attackers.
This issue affects Apache HertzBeat (incubating): before 1.6.0.
Users are recommended to upgrade to version 1.6.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache HertzBeat