CVE-2024-3270 ThingsBoard AdvancedFeature access control

A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may ...

CVE-2024-3270

CVE-2024-3270 affects ThingsBoard up to version 3.6.2, involving the AdvancedFeature component. The vulnerability enables improper access control and can be exploited remotely; public exploit information exists. Vendor plans a fix in version 3.7. Remediation noted: upgrade to ThingsBoard 3.7 or l...

CVE-2024-3270 ThingsBoard AdvancedFeature access control

A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may ...

PT-2024-24786 · Unknown · Thingsboard

Name of the Vulnerable Software and Affected Versions: ThingsBoard versions up to 3.6.2 Description: A problematic issue was found in the AdvancedFeature component, leading to improper access controls. The attack can be initiated remotely. The issue affects unknown code and may be exploited. The...

ThingsBoard 访问控制错误漏洞

ThingsBoard is a Java-based platform for IOT devices for monitoring, management, and data collection by the ThingsBoard team. An access control error vulnerability exists in ThingsBoard 3.6.2 and earlier versions, which stems from an access control error vulnerability in the component...

CVE-2024-3270: Improper Access Control

A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may ...

ThingsBoard Server-Side Template Injection

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

GHSA-6PGR-J9V4-XFVV ThingsBoard Server-Side Template Injection

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

CVE-2023-45303

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

CVE-2023-45303

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

Sql injection

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

CVE-2023-45303

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

CVE-2023-45303: Improper Neutralization of Special Elements in Output Used by a Downstream Component

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

CVE-2023-45303

ThingsBoard before 3.5 is affected by a Server-Side Template Injection via Apache FreeMarker’s freemarker.template.utility.Execute when users can modify an email template and content is sent to /api/admin/settings. Connected sources (Red Hat, OSV, GHSA, CNNVD, CVE lists) confirm the injection roo...

CVE-2023-45303

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

CVE-2023-45303

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

ThingsBoard Injection Vulnerability

Thingsboard is a Java-based platform for monitoring, management, and data collection of IOT devices from the Thingsboard team. A security vulnerability exists in ThingsBoard versions prior to 3.5, which stems from the presence of a server-side template injection vulnerability...

PT-2023-29490 · Apache · Apache Freemarker

Name of the Vulnerable Software and Affected Versions: ThingsBoard versions prior to 3.5 Description: The issue allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the...

GHSA-493P-PFQ6-5258 vulnerabilities

Vulnerabilities for packages: druid, thingsboard, sonarqube-10, celeborn...

CVE-2022-45608

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers CUSTOMERUSER to gain escalated privileges vertically and become an Administrator TENANTADMIN or SYSADMIN on the web application. It is important to note that in order to accomplish this, the attacker must know the...