Lucene search

GoogleOSV:GHSA-M69H-4FRQ-VWQ7

HistoryMay 04, 2023 - 3:30 a.m.

Server-side template injection in beetl

2023-05-0403:30:22

Google

osv.dev

server-side template injection

beetl

render function

ssti

crafted payload

software

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

69.4%

JSON

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.

CPENameOperatorVersion
com.ibeetl:beetleq3.9.0.RELEASE
com.ibeetl:beetleq3.4.0.RELEASE
com.ibeetl:beetleq2.7.19
com.ibeetl:beetleq2.7.23
com.ibeetl:beetleq2.9.9
com.ibeetl:beetleq2.7.27
com.ibeetl:beetleq2.9.1
com.ibeetl:beetleq3.12.0.RELEASE
com.ibeetl:beetleq2.7.16
com.ibeetl:beetleq3.7.0.RELEASE

Name	Operator	Version
com.ibeetl:beetl	eq	3.9.0.RELEASE
com.ibeetl:beetl	eq	3.4.0.RELEASE
com.ibeetl:beetl	eq	2.7.19
com.ibeetl:beetl	eq	2.7.23
com.ibeetl:beetl	eq	2.9.9
com.ibeetl:beetl	eq	2.7.27
com.ibeetl:beetl	eq	2.9.1
com.ibeetl:beetl	eq	3.12.0.RELEASE
com.ibeetl:beetl	eq	2.7.16
com.ibeetl:beetl	eq	3.7.0.RELEASE

Rows per page:

1-10 of 1331

References

gitee.com/xiandafu/beetl/issues/I6RUIP

github.com/javamonkey/beetl2.0

github.com/luelueking/Beetl-3.15.0-vuln-poc

nvd.nist.gov/vuln/detail/CVE-2023-30331

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

69.4%

JSON

Related for OSV:GHSA-M69H-4FRQ-VWQ7