CVE-2021-22053

CVE-2021-22053 affects Spring Cloud Netflix Hystrix Dashboard prior to 2.2.10 when used with spring-boot-starter-thymeleaf. The vulnerability arises because request URI path data is evaluated as SpringEL expressions during view template resolution (example: /hystrix/monitor;[data]), enabling remo...

CVE-2020-5412

Spring Cloud Netflix versions 2.2.x prior to 2.2.4, 2.1.x prior to 2.1.6, and older unsupported versions are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists in the Hystrix Dashboard proxy.stream endpoint, which allows an attacker to force the application to make requests to a...