{"id":"CVE-2023-45303","aliases":["GHSA-6pgr-j9v4-xfvv"],"url":"https://o3.security/vulnerability/CVE-2023-45303","summary":"ThingsBoard Server-Side Template Injection","details":"ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).","published":"2023-10-06T00:00:00Z","modified":"2026-08-07T11:31:06.017206109Z","cvss":{"score":8.4,"severity":"HIGH","vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:R"},"epss":null,"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"Maven","name":"org.thingsboard:thingsboard","fixedVersion":"3.5"}],"fix":null,"references":[{"type":"WEB","url":"https://freemarker.apache.org/docs/api/freemarker/template/utility/Execute.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45303.json"},{"type":"ADVISORY","url":"https://herolab.usd.de/security-advisories/usd-2023-0010/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45303"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:31:06.017206109Z"}}