CVE-2024-42323

Apache HertzBeat: RCE by snakeYaml deser load malicious xml

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers.This issue affects Apache HertzBeat (incubating): before 1.6.0.Users are recommended to upgrade to version 1.6.0, which fixes the issue.

Affected

Apache Software Foundation · Apache HertzBeat

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

8.32% chance of exploitation in the next 30 days, 95th percentile

Nuclei

high · CWE-502

Published

2024-09-21

Updated

2024-09-23

Proof-of-concept exploits (1)

• forwjm/CVE-2024-423230★ · 2026-05-24

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42323.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/hertzbeat/CVE-2024-42323

Security advisories

• https://lists.apache.org/thread/dwpwm572sbwon1mknlwhkpbom2y7skbx
• https://lists.apache.org/thread/r0c4tost4bllqc1n9q6rmzs1slgsq63t

References

• CVE Record
• NVD entry