Description (CNA)
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://herolab.usd.de/security-advisories/usd-2023-0010/
- https://freemarker.apache.org/docs/api/freemarker/template/utility/Execute.html
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.