CVE-2025-24404

HIGH8.8

Apache HertzBeat (incubating): RCE by parse http sitemap xml response

Published Sep 9, 2025

Modified 5 months ago

Details

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat.

The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability.

This issue affects Apache HertzBeat (incubating): before 1.7.0.

Users are recommended to upgrade to version 1.7.0, which fixes the issue.

References

WEB

http://www.openwall.com/lists/oss-security/2025/09/06/4

ADVISORY

https://lists.apache.org/thread/4ydy3tqbpwmhl79mcj3pxwqz62nggrfd

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-24404

CVSS Analysis

CVSS v3.1

8.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.8/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

Other

CWE-91

Ecosystems

Timeline

PublishedSep 9, 2025

ModifiedNov 4, 2025

CVE-2025-24404 | Mondoo Vulnerability Intelligence