What is CVE-2023-51650?

CVE-2023-51650 is a high-severity vulnerability in Apache Hertzbeat, classified under Missing Authorization. CVSS score: 7.5/10. Published 2023-12-22.

How severe is CVE-2023-51650?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Apache Hertzbeat

CVE-2023-51650

Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue.

Vulnerability class: Broken Access Control

EPSS: 0.009 (55.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Apache Hertzbeat
Dromara Hertzbeat — versions < 1.4.1

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2023-51650?: CVE-2023-51650 is a high-severity vulnerability in Apache Hertzbeat, classified under Missing Authorization. CVSS score: 7.5/10. Published 2023-12-22.
How severe is CVE-2023-51650?: High severity. CVSS v3 base score is 7.5 out of 10.