{"action":"Upgrade de.codecentric:spring-boot-admin-server to 2.7.16 (2.x) or 3.1.2 (3.x) or later.","affected":[{"fixed":"3.1.2","introduced":"3.0.0"},{"fixed":"2.7.16","introduced":"0"}],"component":"de.codecentric:spring-boot-admin-server","cve_ids":["CVE-2023-38286"],"ecosystem":"Maven","epss":0.00966,"exploited":false,"fixed_versions":["3.1.2","2.7.16"],"ghsa_id":"GHSA-7gj7-224w-vpr3","id":"tcs_01M5N8JCJGSYRGR658DYQPESRH","modified_at":"2024-06-12T23:03:09.401389Z","published_at":"2023-07-14T06:31:00Z","references":["https://osv.dev/vulnerability/GHSA-7gj7-224w-vpr3","https://nvd.nist.gov/vuln/detail/CVE-2023-38286","https://github.com/codecentric/spring-boot-admin/issues/2613","https://github.com/thymeleaf/thymeleaf/issues/966","https://github.com/codecentric/spring-boot-admin/pull/2615","https://github.com/codecentric/spring-boot-admin/commit/f1f6ac6f613e1c0afc121c8989f28b4155a6797a","https://github.com/codecentric/spring-boot-admin/commit/f1f6ac6f613e1c0afc121c8989f28b4155a6797a#diff-1ea8b144c29588e08221597d56d8be10b4b4a210f248a83f2e837152a3d2e0d7","https://github.com/codecentric/spring-boot-admin","https://github.com/codecentric/spring-boot-admin/blob/master/spring-boot-admin-server/pom.xml","https://github.com/p1n93r/SpringBootAdmin-thymeleaf-SSTI"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-7gj7-224w-vpr3","url":"https://osv.dev/vulnerability/GHSA-7gj7-224w-vpr3"}],"summary":"Spring-boot-admin sandbox bypass via crafted HTML"}