CVE-2023-38286 @ Maven-org.thymeleaf:thymeleaf-3.0.12.RELEASE

[SamHeadrickCx]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2023-38286
Checkmarx Project: SamHeadrickCx/easybuggy4sb
Repository URL: https://github.com/SamHeadrickCx/easybuggy4sb
Branch: master
Scan ID: 94cbf8fd-fbe8-49c7-9c55-da0658f9cbfc

---

Thymeleaf prior to 3.1.2.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if "MailNotifier" is enabled and there is write access to environment variables via the UI.

---

Additional Info
Attack vector: NETWORK
Attack complexity: HIGH
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 3.1.2.RELEASE