{"cvss":0.0,"datePublished":"2022-05-31T00:00:00Z","dateUpdated":"2022-05-31T00:00:00Z","description":"Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.","dueDate":"","id":"CVE-2021-22053","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"Spring Framework","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"VMware Spring Framework Improper Control of Generation of Code","vendor":"VMware"}