What is CVE-2022-46166?

CVE-2022-46166 is a high-severity vulnerability in Codecentric Spring-Boot-Admin, classified under Code Injection. CVSS score: 8.0/10. Published 2022-12-09.

How severe is CVE-2022-46166?

High severity. CVSS v3 base score is 8.0 out of 10.

Is CVE-2022-46166 known to be exploited?

7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Codecentric Spring-Boot-Admin

CVE-2022-46166

Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on `/env` actuator endpoint.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.014 (71.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H.

Affected products

Codecentric Spring-boot-admin — versions < 2.6.10
Codecentric Spring_boot_admin — versions 3.0.0

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory, Mitigation)
security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-46166?: CVE-2022-46166 is a high-severity vulnerability in Codecentric Spring-Boot-Admin, classified under Code Injection. CVSS score: 8.0/10. Published 2022-12-09.
How severe is CVE-2022-46166?: High severity. CVSS v3 base score is 8.0 out of 10.
Is CVE-2022-46166 known to be exploited?: 7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.