VULNERABILITY INTELLIGENCE

CVE-2023-51388

CVSS score9.8 CRITICAL
EPSS probability1.30%
CISA KEVNot currently listed
Published2024-02-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.

Weakness classification

  • security-advisories@github.com: CWE-74
  • nvd@nist.gov: CWE-74

Primary references