CVE-2025-24404

CWE-913 documents3 sources
Severity
8.8HIGH
EPSS
0.1%
top 77.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache Hertzbeat (incubating)Apache Hertzbeat
Timeline
PublishedSep 9

Description

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDapache/hertzbeat< 1.7.0

🔴Vulnerability Details

2
CVEList
Apache HertzBeat (incubating): RCE by parse http sitemap xml response↗2025-09-09
▶
GHSA
GHSA-xp76-33m9-43ww: XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat↗2025-09-09
▶
CVE-2025-24404 (HIGH CVSS 8.8) | XML Injection RCE by parse http sit | cvebase.io