CVE-2021-22053

Name of the Vulnerable Software and Affected Versions spring-cloud-netflix-hystrix-dashboard versions (affected versions not specified)

Description The issue affects applications that use both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf. It exposes a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at "/hystrix/monitor;[user-provided data]", the path elements following hystrix/monitor are being evaluated as SpringEL expressions, which can lead to code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.