{"id":"CVE-2023-51653","aliases":["EUVD-2023-56362","GHSA-gcmp-vf6v-59gg"],"status":"published","title":"Hertzbeat JMX JNDI RCE","description":"Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The corresponding interface is `/api/monitor/detect`. If there is a URL field, the address will be used by default. When the URL is `service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari`, it can be exploited to cause remote code execution. Version 1.4.1 contains a fix for this issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02113,"percentile":0.81967,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74"],"published":"2024-02-22T15:39:49Z","modified":"2026-10-28T10:36:14Z","products":[{"vendor":"apache","product":"hertzbeat"},{"vendor":"dromara","product":"hertzbeat"}],"references":[{"url":"https://github.com/dromara/hertzbeat/security/advisories/GHSA-gcmp-vf6v-59gg","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/dromara/hertzbeat/commit/f794b0d82be49c596c04a042976446559eb315ef","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51653.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51653","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-51653","title":"Hertzbeat JMX JNDI RCE","description":"Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The corresponding interface is `/api/monitor/detect`. If there is a URL field, the address will be used by default. When the URL is `service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari`, it can be exploited to cause remote code execution. Version 1.4.1 contains a fix for this issue.","status":"published","published":"2024-02-22T15:39:49.28Z","modified":"2025-04-22T16:19:23.604Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:35:17.48054Z"}],"euvd":[{"id":"EUVD-2023-56362","description":"Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The corresponding interface is `/api/monitor/detect`. If there is a URL field, the address will be used by default. When the URL is `service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari`, it can be exploited to cause remote code execution. Version 1.4.1 contains a fix for this issue.","status":"published","published":"2024-02-22T15:39:49Z","modified":"2025-04-22T16:19:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:16.055056Z"}],"nvd":[{"id":"CVE-2023-51653","description":"Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The corresponding interface is `/api/monitor/detect`. If there is a URL field, the address will be used by default. When the URL is `service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari`, it can be exploited to cause remote code execution. Version 1.4.1 contains a fix for this issue.","status":"published","published":"2024-02-22T16:15:53.8Z","modified":"2026-06-17T06:41:24.513Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:09:07.077422Z"}],"osv":[{"id":"CVE-2023-51653","title":"Hertzbeat JMX JNDI RCE","description":"Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The corresponding interface is `/api/monitor/detect`. If there is a URL field, the address will be used by default. When the URL is `service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari`, it can be exploited to cause remote code execution. Version 1.4.1 contains a fix for this issue.","status":"published","published":"2024-02-22T15:39:49.28Z","modified":"2026-10-28T10:36:14.390552112Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:35.245372Z"}]}}