ThingsBoard Server-Side Template Injection

ÉLEVÉE 8.8CVE-2023-45303 · GHSA-6pgr-j9v4-xfvv · Published 06/10/2023 · updated 17/06/2026

En bref

CVE-2023-45303 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant org.thingsboard:thingsboard, thingsboard (thingsboard).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.0%, plus élevée que 64.3% des vulnérabilités.
Correctif : mettre à jour vers 3.5 ou plus récent.

Package	Affected versions	Patched versions
org.thingsboard:thingsboard Maven	`< 3.5`	`3.5`
thingsboard thingsboard	`< 3.5`	`3.5`

Description

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint.

NVD description

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).

References

nvd.nist.gov/vuln/detail/CVE-2023-45303 · ADVISORY
freemarker.apache.org/docs/api/freemarker/template/utility/Execute.html · WEB
herolab.usd.de/security-advisories/usd-2023-0010 · WEB
herolab.usd.de/security-advisories/usd-2023-0010 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free