Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

de.codecentric:spring-boot-admin-server

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5MavenPublished

    Spring-boot-admin sandbox bypass via crafted HTML

    CVE-2023-38286 · GHSA-7gj7-224w-vpr3

    Affected
    • Maven de.codecentric:spring-boot-admin-server >= 3.0.0, < 3.1.2; < 2.7.16
    Fixed in
    3.1.22.7.16· Vendor fix available
    Issue
    Thymeleaf through 3.1.1.RELEASE as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 allows for a sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI. Spring Boot Admin 3.1.2 and 2.7.16 contain mitigations for the issue. This bypass is achived via a library called Thymeleaf which has added counter measures for this sort of bypass in version 3.1.2.RELEASE which has explicity forbidden static access to org.springframework.util in expressions. Thymeleaf itself should not be considered vulnerable.

    Recommended action: Upgrade to 3.1.2 or 2.7.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →