VMware Spring Cloud Netflix Remote Code Execution (CVE-2021-22053)

A remote code execution vulnerability exists in VMware Spring Cloud Netflix. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

org.springframework.cloud:spring-cloud-starter-hystrix-dashboard (1.0.6.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.0.7.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

org.springframework.cloud:spring-cloud-starter-hystrix-dashboard (1.4.4.release), org.springframework.cloud:spring-cloud-starter-netflix-hystrix-dashboard (1.4.4.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.4.4.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

com.brinkus.labs:labs-cloud-starter-service (1.6.0), com.ecfront.dew:monitor (>=1.1.2, <=1.1.4) +1 more potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.3.1.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

org.springframework.cloud:spring-cloud-starter-hystrix-dashboard (1.0.3.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.0.3.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

com.17jee:e-cloud-authorize (3.0.0.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.1.3.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

org.springframework.cloud:spring-cloud-starter-hystrix-dashboard (1.0.0.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.0.0.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

com.brinkus.labs:labs-cloud-starter-service (>=1.1.0, <=1.4.0) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.1.5.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.microservices:cloud-altemistafwk-core-microservices-monitoring-conf (3.1.0.release) +27 more potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (>=2.0.0.release, <=2.2.9.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version =2.0.0.release, =2.3.2-0.0.1, =1.0, =1.0, =1.0.4, =1.0.1, =1.0.0, =1.0.3 and more Source cves: CVE-2021-22053 Source advisory: OSV:GHSA-GX3F-HQ7P-8FXV...

org.springframework.cloud:spring-cloud-starter-hystrix-dashboard (1.0.1.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.0.1.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

org.springframework.cloud:spring-cloud-starter-hystrix-dashboard (1.0.2.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.0.2.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

org.springframework.cloud:spring-cloud-starter-hystrix-dashboard (1.4.3.release), org.springframework.cloud:spring-cloud-starter-netflix-hystrix-dashboard (1.4.3.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.4.3.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

CVE-2021-22053

creationtimestamp| type| source ---|---|--- 2021-11-19 18:23:23+00:00| seen| https://t.me/cibsecurity/32701 2021-11-22 09:30:27+00:00| published-proof-of-concept| https://t.me/hackertrick/464 2021-11-22 10:37:29+00:00| published-proof-of-concept| https://t.me/BlueRedTeam/1205 2021-11-22...

CVE-2021-22053

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...

CVE-2021-22053

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...

CVE-2021-22053

CVE-2021-22053 affects Spring Cloud Netflix Hystrix Dashboard prior to 2.2.10 when used with spring-boot-starter-thymeleaf. The vulnerability arises because request URI path data is evaluated as SpringEL expressions during view template resolution (example: /hystrix/monitor;[data]), enabling remo...