CVE-2023-51388 is a critical vulnerability affecting Apache Hertzbeat, a real-time monitoring system. It stems from improper use of AviatorEvaluator in CalculateAlarm.java, allowing unauthenticated attackers to execute arbitrary AviatorScript code due to a lack of security policies. This results in a CVSS score of 9.8 (Critical), indicating complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered significant community discussion, suggesting potential interest from threat actors. Organizations using Hertzbeat should upgrade to version 1.4.1 immediately to remediate this high-risk flaw.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.4.1CPE matchmatch criteria | cpe:2.3:a:apache:hertzbeat:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.