GHSA-gx3f-hq7p-8fxv

Suggest an improvement
Source
https://github.com/advisories/GHSA-gx3f-hq7p-8fxv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-gx3f-hq7p-8fxv/GHSA-gx3f-hq7p-8fxv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gx3f-hq7p-8fxv
Aliases
Published
2021-11-23T17:53:33Z
Modified
2023-11-08T04:04:53.525615Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L CVSS Calculator
Summary
Code injection in spring-cloud-netflix-hystrix-dashboard
Details

Applications using the spring-cloud-netflix-hystrix-dashboard expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;[user-provided data], the path elements following hystrix/monitor are being evaluated as SpringEL expressions, which can lead to code execution.

Database specific 
{
    "nvd_published_at": "2021-11-19T16:15:00Z",
    "github_reviewed_at": "2021-11-22T19:53:38Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-94"
    ]
}
References

Affected packages

Maven / org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard

Package

Name
org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.cloud/spring-cloud-netflix-hystrix-dashboard

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.10.RELEASE

Affected versions

1.*

1.0.0.RELEASE
1.0.1.RELEASE
1.0.2.RELEASE
1.0.3.RELEASE
1.0.4.RELEASE
1.0.6.RELEASE
1.0.7.RELEASE
1.1.0.RELEASE
1.1.1.RELEASE
1.1.2.RELEASE
1.1.3.RELEASE
1.1.4.RELEASE
1.1.5.RELEASE
1.1.6.RELEASE
1.1.7.RELEASE
1.2.0.RELEASE
1.2.1.RELEASE
1.2.2.RELEASE
1.2.3.RELEASE
1.2.4.RELEASE
1.2.5.RELEASE
1.2.6.RELEASE
1.2.7.RELEASE
1.3.0.RELEASE
1.3.1.RELEASE
1.3.2.RELEASE
1.3.3.RELEASE
1.3.4.RELEASE
1.3.5.RELEASE
1.3.6.RELEASE
1.4.0.RELEASE
1.4.1.RELEASE
1.4.2.RELEASE
1.4.3.RELEASE
1.4.4.RELEASE
1.4.5.RELEASE
1.4.6.RELEASE
1.4.7.RELEASE

2.*

2.0.0.RELEASE
2.0.1.RELEASE
2.0.2.RELEASE
2.0.3.RELEASE
2.0.4.RELEASE
2.1.0.RELEASE
2.1.1.RELEASE
2.1.2.RELEASE
2.1.3.RELEASE
2.1.4.RELEASE
2.1.5.RELEASE
2.1.6.RELEASE
2.2.0.RELEASE
2.2.1.RELEASE
2.2.2.RELEASE
2.2.3.RELEASE
2.2.4.RELEASE
2.2.5.RELEASE
2.2.6.RELEASE
2.2.7.RELEASE
2.2.8.RELEASE
2.2.9.RELEASE

Database specific 

{
    "last_known_affected_version_range": "<= 2.2.9.RELEASE"
}