CVE-2023-45303

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports…

High · published October 6, 2023

CVSS v3.1
8.4
EPSS
1%
Percentile
64.0
In the wild
Unconfirmed
What it is

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:R
CVSS v4.0
Not supplied
EPSS
0.01049 · 64.0th percentile
Published
2023-10-06T00:00Z
EPSS history
Timeline
  • 06 OCT 00:00Z
    ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports…
    cvelistv5