CVE-2023-45303: High severity thingsboard advancedfeature vulnerability
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint.
Other sources
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-45303?
CVE-2023-45303 is a vulnerability in ThingsBoard before version 3.5 that allows Server-Side Template Injection.
How does the vulnerability in ThingsBoard before version 3.5 occur?
The vulnerability occurs if users are allowed to modify an email template and Apache FreeMarker supports `freemarker.template.utility.Execute` for content sent to the `/api/admin/settings` endpoint.
What is the severity of CVE-2023-45303?
The severity of CVE-2023-45303 is high, with a CVSS score of 8.4.
Which software versions are affected by CVE-2023-45303?
ThingsBoard versions up to and exclusive of 3.5, as well as the Maven package `org.thingsboard:thingsboard` up to and exclusive of version 3.5, are affected.
How can I fix CVE-2023-45303?
To fix CVE-2023-45303, upgrade ThingsBoard to version 3.5 or higher and ensure that users cannot modify email templates with code injection vulnerabilities.