Security Advisory
CVE-2023-45303
8.4
HIGH
Vulnerability Description
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).
Published Date
October 6, 2023
Official Source
NIST NVD Advisory