CVE-2021-43466 @ Maven-org.thymeleaf:thymeleaf-spring5-3.0.12.RELEASE

[AASMACMX]

Vulnerable Package issue exists @ Maven-org.thymeleaf:thymeleaf-spring5-3.0.12.RELEASE in branch main

In the thymeleaf-spring3:3.0.12, thymeleaf-spring4:3.0.12, thymeleaf-spring5:3.0.12 components, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.

Namespace: CxDemoInABoxRepos
Repository: Java-Webgoat
Repository Url: https://github.com/CxDemoInABoxRepos/Java-Webgoat
CxAST-Project: CxDemoInABoxRepos/Java-Webgoat
CxAST platform scan: 54f047f8-7049-4205-83b9-9e21c75dc4c9
Branch: main
Application: Java-Webgoat
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-94

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 3.0.13.RELEASE

---

References
Advisory
Issue
Commit
Issue