CVE-2022-46166CWE-94

Spring Boot Admins integrated notifier support allows arbitrary code execution

High · published December 9, 2022

CVSS v3.1
8.1
EPSS
2%
Percentile
75.1
In the wild
Unconfirmed
What it is

Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on `/env` actuator endpoint.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01567 · 75.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2022-12-09T20:11Z
EPSS history
Timeline
  • 09 DEC 20:11Z
    Spring Boot Admins integrated notifier support allows arbitrary code execution
    cvelistv5