CVE-2021-22053
CVE-2021-22053
Vexday Risk Score
23Bajo
Decisión SSVC (CISA)
Attend
PoC disponible → seguir de cerca
CVSS —EPSS 12.7%KEV nãoPoC —Nuclei simMetasploit —Patch —
Ciclo de vida
19 nov 2021Publicada en NVD
Recomendación: Planificar corrección próxima — ya existe PoC pública.
Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.
Productos afectados
n/a · Spring Cloud Netflix¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →