CVE-2024-42361

Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to download job metrics. In the process, it executes a SQL query with user-controlled data, allowing for SQL injection.

• CWE-89
• CWE-89

• https://github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/manager/src/main/java/org/dromara/hertzbeat/manager/controller/MonitorsController.java#L202Patch
• https://github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/warehouse/src/main/java/org/dromara/hertzbeat/warehouse/store/HistoryTdEngineDataStorage.java#L242Patch
• https://github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/warehouse/src/main/java/org/dromara/hertzbeat/warehouse/store/HistoryTdEngineDataStorage.java#L295Patch
• https://securitylab.github.com/advisories/GHSL-2023-254_GHSL-2023-256_HertzBeat/Exploit, Third Party Advisory

Published

Aug 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42355Shopware, an open ecommerce platform, has a new Twig Tag `sw…9.8
• CVE-2024-42356Shopware is an open commerce platform. Prior to versions 6.6…7.2
• CVE-2024-42357Shopware is an open commerce platform. Prior to versions 6.6…9.8
• CVE-2024-42358PDFio is a simple C library for reading and writing PDF file…5.5
• CVE-2024-4236A vulnerability, which was classified as critical, has been …8.8
• CVE-2024-42360SequenceServer lets you rapidly set up a BLAST+ server with …9.8
• CVE-2024-42362Hertzbeat is an open source, real-time monitoring system. He…8.8
• CVE-2024-42363Prior to 3385, the user-controlled role parameter enters the…8.8
• CVE-2024-42364Homepage is a highly customizable homepage with Docker and s…6.5
• CVE-2024-42365Asterisk is an open source private branch exchange (PBX) and…8.8
• CVE-2024-42366VRCX is an assistant/companion application for VRChat. In ve…9
• CVE-2024-42367aiohttp is an asynchronous HTTP client/server framework for …4.8