CVE-2022-46166

Description

Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on /env actuator endpoint.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

23.368

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2022-46166 are fixed in Codecentric - spring-boot-admin 2.6.10	Windows
Vulnerabilities CVE-2022-46166 are fixed in Codecentric - spring-boot-admin 2.7.8	Windows
Vulnerabilities CVE-2022-46166 are fixed in Codecentric - spring-boot-admin 3.0.0	Windows
Vulnerabilities CVE-2022-46166 are fixed in Codecentric - spring-boot-admin for Linux 2.6.10	Linux
Vulnerabilities CVE-2022-46166 are fixed in Codecentric - spring-boot-admin for Linux 2.7.8	Linux
Vulnerabilities CVE-2022-46166 are fixed in Codecentric - spring-boot-admin for Linux 3.0.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234