Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2023-38286
7.5
HIGHCVSS v3
Published
July 14, 2023
Affected
2 projects
Assigned by
MITRE
Severity scale
010
Description
Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.
thymeleaf/thymeleaf
GitHubThymeleaf is a modern server-side Java template engine for both web and standalone environments.
GitHubThymeleaf is a modern server-side Java template engine for both web and standalone environments.<= 3.1.1NVD
NPM