CVE-2024-42362— GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-42362
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import
Source: NVD (National Vulnerability Database)
Vulnerability Description
Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
可信数据的反序列化
Source: NVD (National Vulnerability Database)
Vulnerability Title
Hertzbeat 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Hertzbeat是dromara组织的一个开源的实时监控系统。 Hertzbeat 1.6.0 版本之前存在安全漏洞，该漏洞源于 /api/monitors/import 位置存在一个不安全的反序列化问题，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-42362
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-42362
请登录查看更多情报信息。
- https://github.com/apache/hertzbeat/pull/1611x_refsource_MISC
- https://github.com/apache/hertzbeat/pull/1620x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2024-42362
IV. Related Vulnerabilities
Same vendor: Apache
- CVE-2025-58712
Amq: privilege escalation via excessive /etc/passwd permissi - CVE-2024-42361
GHSL-2023-256: HertzBeat Authenticated (guest role) SQL inje - CVE-2021-32824
Regular expression Denial of Service in MooTools - CVE-2021-25958
Generation of Error Message Containing Sensitive Information - CVE-2020-11996
Apache Tomcat 资源管理错误漏洞
Same weakness: CWE-502
- CVE-2026-44126
Insecure deserialization - CVE-2026-5127
User Frontend: AI Powered Frontend Posting, User Directory, - CVE-2026-41586
ObjectInputStream.readObject() without ObjectInputFilter in - CVE-2026-34084
PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFac - CVE-2026-7712
MindsDB Pickle pickle.loads deserialization
V. Comments for CVE-2024-42362
No comments yet