diff --git a/cves/2021/CVE-2021-22053.yaml b/cves/2021/CVE-2021-22053.yaml index 3fd635de60..562eabe109 100644 --- a/cves/2021/CVE-2021-22053.yaml +++ b/cves/2021/CVE-2021-22053.yaml @@ -5,7 +5,7 @@ info: author: forgedhallpass severity: high description: | - Spring Cloud Netflix Hystrix Dashboard <2.2.10 is susceptible to remote code execution. Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution. + Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution. reference: - https://github.com/SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053 - https://tanzu.vmware.com/security/cve-2021-22053