CVE-2025-48208 — Apache HertzBeat (incubating): Jmx JNDI injection vulnerability

Description (CNA)

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat . The attacker needs to have an authenticated account with access, and the attack can only be triggered by crafting custom commands. A successful attack would result in arbitrary script execution. This issue affects Apache HertzBeat: through 1.7.2. Users are recommended to upgrade to version [1.7.3], which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache HertzBeat (incubating)	affected 0 through 1.7.2

CWE

CWE-90

References

https://lists.apache.org/thread/3zrr3oo67pxxx7wgzj80kglltfshngn2

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/09/06/5