CVE-2025-24404

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-24404

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24404.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-24404

Published

2025-09-09T10:15:33.087Z

Modified

2026-04-10T05:23:02.000906Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat.

The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability.

This issue affects Apache HertzBeat (incubating): before 1.7.0.

Users are recommended to upgrade to version 1.7.0, which fixes the issue.

References

Affected packages

Git / github.com/apache/hertzbeat

Affected ranges

Type

GIT

Repo

https://github.com/apache/hertzbeat

Events

Introduced

Fixed

b77222765c06e895e61c972dfdf8df38c66e6610

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.7.0"
        }
    ]
}

Affected versions

v1.*

v1.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24404.json"