未評価
Apache HertzBeat (incubating): RCE by parse http sitemap xml response
CVE-2025-24404
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat.
The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability.
This issue affects Apache HertzBeat (incubating): before 1.7.0.
Users are recommended to upgrade to version 1.7.0, which fixes the issue.
参照URL
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- web openwall.com