VULNERABILITY INTELLIGENCE

CVE-2021-23258

CVSS score4.2 MEDIUM
EPSS probability0.73%
CISA KEVNot currently listed
Published2021-12-02
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H

Description

Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).

Weakness classification

  • security@craftersoftware.com: CWE-913
  • nvd@nist.gov: CWE-913

Primary references