Maven package

org.thingsboard/thingsboard

pkg:maven/org.thingsboard/thingsboard

Vulnerabilities (1)

CVE	Sev	CVSS	KEV	Affected versions	Fixed in	Published	Description
CVE-2023-45303		—		< 3.5	3.5	Oct 6, 2023	ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).

CVE-2023-45303Oct 6, 2023
affected < 3.5fixed 3.5
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).