CVE-2022-39337

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-39337
Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876 Patch
https://github.com/dromara/hertzbeat/issues/377 Exploit Issue Tracking
https://github.com/dromara/hertzbeat/pull/382 Issue Tracking Patch
https://github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6 Vendor Advisory
https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876 Patch
https://github.com/dromara/hertzbeat/issues/377 Exploit Issue Tracking
https://github.com/dromara/hertzbeat/pull/382 Issue Tracking Patch
https://github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:hertzbeat:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:18

Type Values Removed Values Added
References () https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876 - Patch () https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876 - Patch
References () https://github.com/dromara/hertzbeat/issues/377 - Exploit, Issue Tracking () https://github.com/dromara/hertzbeat/issues/377 - Exploit, Issue Tracking
References () https://github.com/dromara/hertzbeat/pull/382 - Issue Tracking, Patch () https://github.com/dromara/hertzbeat/pull/382 - Issue Tracking, Patch
References () https://github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6 - Vendor Advisory () https://github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6 - Vendor Advisory

28 Aug 2024, 15:44

Type Values Removed Values Added
CPE cpe:2.3:a:dromara:hertzbeat:*:*:*:*:*:*:*:* cpe:2.3:a:apache:hertzbeat:*:*:*:*:*:*:*:*
First Time Apache
Apache hertzbeat

02 Jan 2024, 20:27

Type Values Removed Values Added
First Time Dromara hertzbeat
Dromara
CPE cpe:2.3:a:dromara:hertzbeat:*:*:*:*:*:*:*:*
Summary
  • (es) Hertzbeat es un sistema de monitoreo en tiempo real de código abierto con monitoreo personalizado, clúster de alto rendimiento, similar a Prometheus y sin agentes. Las versiones 1.20 y anteriores de Hertzbeat tienen una vulnerabilidad de omisión de permisos. La autenticación del sistema se puede omitir e invocar interfaces sin autorización. La versión 1.2.1 contiene un parche para este problema.
References () https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876 - () https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876 - Patch
References () https://github.com/dromara/hertzbeat/issues/377 - () https://github.com/dromara/hertzbeat/issues/377 - Exploit, Issue Tracking
References () https://github.com/dromara/hertzbeat/pull/382 - () https://github.com/dromara/hertzbeat/pull/382 - Issue Tracking, Patch
References () https://github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6 - () https://github.com/dromara/hertzbeat/security/advisories/GHSA-434f-f5cw-3rj6 - Vendor Advisory

22 Dec 2023, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-22 15:15

Updated : 2024-11-21 07:18

NVD link : CVE-2022-39337

Mitre link : CVE-2022-39337

CVE.ORG link : CVE-2022-39337

JSON object : View

Products Affected

apache

  • hertzbeat
CWE
CWE-284

Improper Access Control

CWE-863

Incorrect Authorization