GHSA-7GJ7-224W-VPR3 Spring-boot-admin sandbox bypass via crafted HTML

Thymeleaf through 3.1.1.RELEASE as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 allows for a sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there is write access ...

Spring-boot-admin sandbox bypass via crafted HTML

Thymeleaf through 3.1.1.RELEASE as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 allows for a sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there is write access ...

de.codecentric:spring-boot-admin-sample (1.1.0), de.codecentric:spring-boot-admin-sample-hazelcast (1.1.0) potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.1.0)

de.codecentric:spring-boot-admin-server MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.1.0 -...

de.codecentric:spring-boot-admin-sample (1.2.3), de.codecentric:spring-boot-admin-sample-discovery (1.2.3) +1 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.2.3)

de.codecentric:spring-boot-admin-server MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.2.3 -...

de.codecentric:spring-boot-admin-sample (1.4.1), de.codecentric:spring-boot-admin-sample-consul (1.4.1) +4 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.4.1)

de.codecentric:spring-boot-admin-server MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.4.1 -...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24), cn.tworice:tworice-monitor-starter (>=1.2.3-release, <=1.5.3) +48 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (>=2.0.0, <=2.7.15)

de.codecentric:spring-boot-admin-server MAVEN version =2.0.0, =0.5.0, =1.2.3-release, =3.0.3.release, =1.0.0, =1.1.3, =3.0.10, =1.0.0, =5.0.18, =2.0.1, =2.0.1, =2.0.0, =2.7.15 and more Source cves: CVE-2023-38286 Source advisory: GHSA-7GJ7-224W-VPR3...

com.netcetera.girders.demos:girders-demo-adminserver (>=6.0.0-m2, <=6.1.0), com.senzhikong:depend-cloud-monitor (>=1.1.0, <=1.1.1) +11 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (>=3.0.0, <=3.1.1)

de.codecentric:spring-boot-admin-server MAVEN version =3.0.0, =6.0.0-m2, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.0-rc4, =7.0.0-rc6 Source cves: CVE-2023-38286 Source advisory: OSV:GHSA-7GJ7-224W-VPR3...

de.codecentric:spring-boot-admin-sample (1.2.2), de.codecentric:spring-boot-admin-sample-discovery (1.2.2) +1 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.2.2)

de.codecentric:spring-boot-admin-server MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.2.2 -...

de.codecentric:spring-boot-admin-example (1.0.4) potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.0.4)

de.codecentric:spring-boot-admin-server MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-example 1.0.4 Source cves: CVE-2023-38286 Source...

de.codecentric:spring-boot-admin-sample (1.2.0), de.codecentric:spring-boot-admin-sample-discovery (1.2.0) +1 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.2.0)

de.codecentric:spring-boot-admin-server MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.2.0 -...

de.codecentric:spring-boot-admin-sample (1.3.0), de.codecentric:spring-boot-admin-sample-discovery (1.3.0) +2 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.3.0)

de.codecentric:spring-boot-admin-server MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.3.0 -...

com.netcetera.girders.demos:girders-demo-adminserver (>=6.0.0-m2, <=6.1.0), com.senzhikong:depend-cloud-monitor (>=1.1.0, <=1.1.1) +11 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (>=3.0.0, <=3.1.1)

de.codecentric:spring-boot-admin-server MAVEN version =3.0.0, =6.0.0-m2, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.0-rc4, =7.0.0-rc6 Source cves: CVE-2023-38286 Source advisory: GHSA-7GJ7-224W-VPR3...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

Design/Logic Flaw

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2023-38286: Improper Neutralization of Special Elements used in a Command

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2023-38286

Thymeleaf 3.1.1.RELEASE (used in Spring Boot Admin up to 3.1.1) is affected by a sandbox bypass via crafted HTML, enabling potential SSTI and code execution if MailNotifier is enabled with write access to environment variables in the UI. Affected products: Thymeleaf 3.1.1.RELEASE and Spring Boot ...