CVE-2022-39337 Permission bypass due to incorrect configuration in github.com/dromara/hertzbeat
Attackers can bypass system authentication to invoke interfaces without authorization in the Hertzbeat monitoring system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-39337?
CVE-2022-39337 is a high-severity authentication bypass vulnerability in dromara hertzbeat, published on 22 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue.
Which versions are affected by CVE-2022-39337?
It affects 1 product.
Products include Apache Hertzbeat.
How do I fix CVE-2022-39337?
No fix has been published for CVE-2022-39337 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-39337 being exploited?
There is no known exploitation of CVE-2022-39337 in the wild and no public exploit code.
Other vulnerabilities in dromara hertzbeat
- CVE-2023-51388 HertzBeat AviatorScript Inject RCE
- CVE-2023-51389 HertzBeat SnakeYAML Deser RCE
- CVE-2023-51653 Hertzbeat JMX JNDI RCE
- CVE-2026-24343 Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions
- CVE-2025-24404 Apache HertzBeat (incubating): RCE by parse http sitemap xml response
Sources
Also known as GHSA-434f-f5cw-3rj6.