CVE-2023-51650 - OpenCVE

Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Dromara	Hertzbeat

Configuration 1 [-]

cpe:2.3:a:dromara:hertzbeat:*:*:*:*:*:*:*:*

References

Link	Resource
https://github.com/dromara/hertzbeat/releases/tag/v1.4.1	Release Notes
https://github.com/dromara/hertzbeat/security/advisories/GHSA-rrc5-qpxr-5jm2	Exploit Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-12-22T20:56:37.097Z

Updated: 2023-12-22T20:56:37.097Z

Reserved: 2023-12-20T22:12:04.737Z

Link: CVE-2023-51650

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-12-22T21:15:09.503

Modified: 2024-01-03T19:53:37.357

Link: CVE-2023-51650

JSON object: View

Redhat Information

No data.

CWE

CWE-862

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dromara:hertzbeat:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA9DA6B7-E31D-4037-BB20-38E777BF59BF", "versionEndExcluding": "1.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue.\n"}, {"lang": "es", "value": "Hertzbeat es un sistema de monitoreo en tiempo real de c\u00f3digo abierto. Antes de la versi\u00f3n 1.4.1, los problemas de configuraci\u00f3n de permisos de Spring Boot provocaban vulnerabilidades de acceso no autorizado a tres interfaces. Esto podr\u00eda resultar en la divulgaci\u00f3n de informaci\u00f3n confidencial del servidor. La versi\u00f3n 1.4.1 soluciona este problema."}], "id": "CVE-2023-51650", "lastModified": "2024-01-03T19:53:37.357", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-12-22T21:15:09.503", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/dromara/hertzbeat/releases/tag/v1.4.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/dromara/hertzbeat/security/advisories/GHSA-rrc5-qpxr-5jm2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Primary"}]}