What is GHSA-6pgr-j9v4-xfvv?

GHSA-6pgr-j9v4-xfvv is a security advisory published by GitHub Security Advisories with High severity. ThingsBoard Server-Side Template Injection

Which CVE IDs does GHSA-6pgr-j9v4-xfvv cover?

GHSA-6pgr-j9v4-xfvv covers the following CVE IDs: CVE-2023-45303. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6pgr-j9v4-xfvv?

GHSA-6pgr-j9v4-xfvv has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-6pgr-j9v4-xfvv?

GHSA-6pgr-j9v4-xfvv affects 1 product, including: maven/org.thingsboard:thingsboard:\u003c 3.5.

GHSA-6pgr-j9v4-xfvvHighCVSS 8.8

ThingsBoard Server-Side Template Injection

Vendor

GitHub Security Advisories

Published

October 6, 2023

Last Modified

November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-45303 →

📋 Description

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint.

🎯 Affected products1

maven/org.thingsboard:thingsboard:< 3.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-45303
https://freemarker.apache.org/docs/api/freemarker/template/utility/Execute.html
https://herolab.usd.de/security-advisories/usd-2023-0010/
https://github.com/advisories/GHSA-6pgr-j9v4-xfvv