CVE-2021-23258 — Spring SPEL Expression Language Injection
Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which …
Published: 2021-12-02 · CVSS: 4.2 · CVSS 3.1
Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7