CVE-2021-22053CWE-94

Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request…

published November 19, 2021

CVSS
—
EPSS
13%
Percentile
96.4
In the wild
Unconfirmed
What it is

Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.13235 · 96.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2021-11-19T15:56Z
EPSS history
Timeline
  • 19 NOV 15:56Z
    Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request…
    cvelistv5