Beveiligingsadvies

CVE-2023-51388

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2024-02-22 15:53:46

Laatst bijgewerkt 2024-08-14 19:09:04

Toegewezen door GitHub_M

CVSS-score 9.8

Status PUBLISHED

Beschrijving

Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.

← Alle CVE's bekijken Bekijk op cve.org ↗