CVE-2023-45303 Vulnerability in maven package org.thingsboard:thingsboard

Description

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).

Remediation

References

https://freemarker.apache.org/docs/api/freemarker/template/utility/Execute.html

https://herolab.usd.de/security-advisories/usd-2023-0010/

Related Vulnerabilities

CVE-2018-19057 Vulnerability in maven package org.webjars.npm:simplemde

CVE-2021-31684 Vulnerability in maven package net.minidev:json-smart

CVE-2020-12725 Vulnerability in npm package redash

CVE-2017-16158 Vulnerability in npm package dcserver

CVE-2020-28443 Vulnerability in npm package sonar-wrapper

Severity

Critical

Classification

CWE-74 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H