CVE-2024-45505highCWE-77

CVE-2024-45505: fallo de gravedad alta en Apache HertzBeat

Apache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities

Publicada el

Seguir esta CVE+ Monitorear Apache HertzBeat

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 2.2%
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Apache Software Foundation · Apache HertzBeat
CVEs relacionadas — Apache HertzBeat

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-42323HIGHApache HertzBeat: RCE by snakeYaml deser load malicious xmlEPSS 8.3%CVE-2024-41151HIGHApache HertzBeat: RCE by notice template injection vulnerabilityEPSS 1.0%CVE-2024-45791HIGHApache HertzBeat: Exposure sensitive token via http GET method with query stringEPSS 0.8%CVE-2026-24343HIGHApache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath ExpressionsEPSS 0.7%CVE-2024-56736MEDIUMApache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config OssEPSS 0.7%CVE-2026-114442MEDIUMApache HertzBeat: incomplete XPath expression validation in aliasFieldsEPSS 0.5%