CVE-2021-22053

2021-11-1916:15:07

Google

osv.dev

code execution vulnerability

spring-cloud-netflix-hystrix-dashboard

spring-boot-starter-thymeleaf

uri path vulnerability

view templates

AI Score

7.3

Confidence

Low

EPSS

0.628

Percentile

97.9%

JSON

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;[user-provided data], the path elements following hystrix/monitor are being evaluated as SpringEL expressions, which can lead to code execution.