CVE-2022-46166

Katalog CVE

CVSS 9.8 · Critical EPSS 1,6%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada codecentric spring boot admin. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on `/env` actuator endpoint.

Rincian

Terbit di NVD

9 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/codecentric/spring-boot-admin/commit/c14c3ec12533f71f84de9ce3ce5ceb7991975f75 patch · advisory pihak ketiga
• https://github.com/codecentric/spring-boot-admin/security/advisories/GHSA-w3x5-427h-wfq6 mitigasi · advisory pihak ketiga