High severity · published Jul 14, 2023
CVE-2023-38286
Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML
7.5
CVSS
1%
EPSS
No
On KEV
Description
Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Spring Boot Admin · Codecentric
through 3.1.0 · source: NVD
TH
Thymeleaf · Thymeleaf
through 3.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-38286
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-38286
Exploit
https://github.com/p1n93r/SpringBootAdmin-thymeleaf-SSTI
More from Spring Boot Admin
9.8
CVE-2022-46166
Spring boot admins is an open source administrative user interface for management of spring boot applications
8.6
CVE-2026-62242
Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration