CVE-2023-30331

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
VendorProductVersion
beetl_projectbeetl
3.15:0
𝑥
= Vulnerable software versions
References
https://gitee.com/xiandafu/beetl/issues/I6RUIP
https://github.com/luelueking/Beetl-3.15.0-vuln-poc
https://gitee.com/xiandafu/beetl/issues/I6RUIP
https://github.com/luelueking/Beetl-3.15.0-vuln-poc