GitHub Advisoryadvisory · Maven

GHSA-6pgr-j9v4-xfvv ThingsBoard Server-Side Template Injection

HIGH Published 2023-10-06 Modified 2023-10-17 Official page ↗
Aliases
CVE-2023-45303
Ecosystem
Maven
Packages
org.thingsboard:thingsboard
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2023-10-17

Affected packages

• Maven org.thingsboard:thingsboard: < 3.5 → fixed in 3.5

Description

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports `freemarker.template.utility.Execute` for content sent to the `/api/admin/settings` endpoint.

Related

Alias · CVE (1)

  • CVE-2023-45303 ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References