{"id":"CVE-2023-51388","state":"PUBLISHED","title":"HertzBeat AviatorScript Inject RCE","description":"Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.","publishedAt":"2024-02-22T15:53:46.458Z","updatedAt":"2024-08-14T19:09:04.986Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["dromara hertzbeat"],"affected":[{"vendor":"dromara","product":"hertzbeat","versions":[{"version":"< 1.4.1","status":"affected"}]}],"references":["https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgj","https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2"],"weaknesses":["CWE-74"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/51xxx/CVE-2023-51388.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-51388","state":"PUBLISHED","datePublished":"2024-02-22T15:53:46.458Z","dateUpdated":"2024-08-14T19:09:04.986Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2023-12-18T19:35:29.003Z"},"containers":{"cna":{"title":"HertzBeat AviatorScript Inject RCE","descriptions":[{"lang":"en","value":"Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability."}],"affected":[{"vendor":"dromara","product":"hertzbeat","versions":[{"version":"< 1.4.1","status":"affected"}]}],"references":[{"url":"https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgj","name":"https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgj","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2","name":"https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-74","lang":"en","description":"CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2024-02-22T15:53:46.458Z"},"source":{"advisory":"GHSA-mcqg-gqxr-hqgj","discovery":"UNKNOWN"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgj","name":"https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgj","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2","name":"https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T22:32:09.231Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"dromara","product":"hertzbeat","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.4.1","versionType":"custom"}],"cpes":["cpe:2.3:a:dromara:hertzbeat:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-14T19:08:29.282771Z","id":"CVE-2023-51388","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-14T19:09:04.986Z"}}]}}}