VULNERABILITY INTELLIGENCE

CVE-2024-22533

CVSS score9.8 CRITICAL

EPSS probability1.03%

CISA KEVNot currently listed

Published2024-02-02

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading to arbitrary code execution.

Weakness classification

nvd@nist.gov: CWE-94
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-94

Primary references

cve@mitre.org — Exploit, Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Vendor Advisory