CVE-2021-22053

2021-11-1915:56:11

CWE-94

vmware

www.cve.org

cve-2021-22053

spring-cloud-netflix-hystrix-dashboard

spring-boot-starter-thymeleaf

code execution

request uri path

view templates

springel expressions

AI Score

9.2

Confidence

High

EPSS

0.628

Percentile

97.9%

JSON

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;[user-provided data], the path elements following hystrix/monitor are being evaluated as SpringEL expressions, which can lead to code execution.

CNA Affected

[
  {
    "product": "Spring Cloud Netflix",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Spring Cloud Netflix versions 2.2.x prior to 2.2.10.Release + and old unsupported versions"
      }
    ]
  }
]