CVE-2024-42323

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers.This issue affects Apache HertzBeat (incubating): before 1.6.0.Users are recommended to upgrade to version 1.6.0, which fixes the issue.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

8.32% chance of exploitation in the next 30 days, 95th percentile

Nuclei

high · CWE-502

Published

2024-09-21

Updated

2024-09-23

Proof-of-concept exploits (1)

• forwjm/CVE-2024-42323

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42323.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/hertzbeat/CVE-2024-42323

References

• CVE Record
• NVD entry

Related

• CVE-2024-4232
• CVE-2024-42327
• CVE-2024-4231
• CVE-2024-42346
• CVE-2024-4217
• CVE-2024-42348