ThingsBoard Server-Side Template Injection
Date: 2023-10
Affected: maven/org.thingsboard:thingsboard
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-45303
CWE: CWE-74
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports `freemarker.template.utility.Execute` for content sent to the `/api/admin/settings` endpoint.


Mitigations:

Architectural layers (MAESTRO):