Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on `/env` actuator endpoint.
References
Link | Resource |
---|---|
https://github.com/codecentric/spring-boot-admin/commit/c14c3ec12533f71f84de9ce3ce5ceb7991975f75 | Patch Third Party Advisory |
https://github.com/codecentric/spring-boot-admin/security/advisories/GHSA-w3x5-427h-wfq6 | Mitigation Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2022-12-09T20:11:11.646Z
Updated:
Reserved: 2022-11-28T17:27:19.998Z
Link: CVE-2022-46166
JSON object: View
NVD Information
Status : Modified
Published: 2022-12-09T21:15:14.843
Modified: 2023-11-07T03:55:03.810
Link: CVE-2022-46166
JSON object: View
Redhat Information
No data.
CWE