CVE-2024-42361

CWE-89 — SQL Injection2 documents2 sources
Severity
9.8CRITICAL
EPSS
0.2%
top 52.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Hertzbeat
Timeline
PublishedAug 20

Description

Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to download job metrics. In the process, it executes a SQL query with user-controlled data, allowing for SQL injection.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDapache/hertzbeat< 1.6.0
▶CVEListV5apache/hertzbeat1.6.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
CVEList
GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}↗2024-08-20
▶
CVE-2024-42361 (CRITICAL CVSS 9.8) | Hertzbeat is an open source | cvebase.io