JeecgBoot server-side template injection

严重 9.8CVE-2023-41544 · GHSA-49jp-cghc-p5pj · Published 30/12/2023 · updated 17/06/2026

要点

CVE-2023-41544 是影响 org.jeecgframework.boot:jeecg-boot-common, jeecg boot (jeecg) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：2.7%，高于 85.8% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
org.jeecgframework.boot:jeecg-boot-common Maven	`≤ 3.5.3`	No fix yet
jeecg boot jeecg	`≤ 3.5.3`	No fix yet

Description

SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.

NVD description

SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.

References

nvd.nist.gov/vuln/detail/CVE-2023-41544 · ADVISORY
jeecgboot/jeecg-boot · PACKAGE
pho3n1x-web.github.io/2023/09/18/CVE-2023-41544%28JeecgBoot_SSTI%29 · WEB
pho3n1x-web.github.io/2023/09/18/CVE-2023-41544%28JeecgBoot_SSTI%29 · Exploit

org.jeecgframework.boot:jeecg-boot-common 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jeecgframework.boot:jeecg-boot-common

Maven

≤ 3.5.3

No fix yet

jeecg boot

jeecg

≤ 3.5.3

No fix yet

Description

SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.

NVD description

SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.

org.jeecgframework.boot:jeecg-boot-common 的其他漏洞

查看全部 →