CVE-2023-45303 (published 2023-10-06T00:00:00)
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).
Affected products: Vendor: n/a
Product: n/a
Versions: n/a