CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-22533
Critical (9.8) in xiandafu beetl. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in com.ibeetl:beetl-core 3.15.13.RELEASE.
Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading to arbitrary code execution.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- xiandafu:beetl
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9gh8-877r-g477 | Maven | com.ibeetl:beetl-core | <3.15.13.RELEASE | 3.15.13.RELEASE |