CVE-2023-51388
HertzBeat AviatorScript Inject RCE
概要
HertzBeat AviatorScript Inject RCE
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Hertzbeat is a real-time monitoring system. In CalculateAlarm.java, AviatorEvaluator is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com