CVE-2023-51388
HertzBeat AviatorScript Inject RCE
Résumé
HertzBeat AviatorScript Inject RCE
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Hertzbeat is a real-time monitoring system. In CalculateAlarm.java, AviatorEvaluator is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com