Back to Database
Status published
High
CVE-2022-39337
Permission bypass due to incorrect configuration in github.com/dromara/hertzbeat
Vulnerability Description
Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39337
Credits & Attribution
No credits recorded in the NVD database.
References
More from dromara
View All →CVE-2023-51653
Hertzbeat JMX JNDI RCE
Critical
9.8
CVE-2023-51650
Unauthorized access vulnerability on three interfaces
High
7.5
CVE-2023-51389
HertzBeat SnakeYAML Deser RCE
Critical
9.8
CVE-2023-51388
HertzBeat AviatorScript Inject RCE
Critical
9.8
CVE-2023-51387
Expression Injection Vulnerability in Hertzbeat
High
7.2
Affected Vendor
dromara
View all reports →Affected Software
hertzbeat
Vulnerable Versions:
<= 1.2.0
Timeline
Official Publish:
December 22nd, 2023
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
MITRE ATT&CK TTPs
T1190
Exploit Public-Facing Application
Initial Access
T1068
Exploitation for Privilege Escalation
Privilege Escalation
T1078
Valid Accounts
Persistence
T1213
Data from Information Repositories
Collection
T1565.002
Stored Data Manipulation
Impact
T1548
Abuse Elevation Control Mechanism
Privilege Escalation
T1021
Remote Services
Lateral Movement
T1098
Account Manipulation
Defense Evasion