CVE-2022-46166 json
Spring Boot Admins integrated notifier support allows arbitrary code execution
published 3y ago modified 4mo ago also GHSA-w3x5-427h-wfq6 , EUVD-2022-7754
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on `/env` actuator endpoint.
Patch / fix
- maven de.codecentric:spring-boot-admin 2.6.10, 2.7.8, 3.0.0-M6
- codecentric spring_boot_admin 2.6.10, 2.7.8
Is CVE-2022-46166 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
1.57% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | de.codecentric:spring-boot-admin | <2.6.10 >=2.7.0, <2.7.8 >=3.0.0-M1, <3.0.0-M6 |
2.6.10 2.7.8 3.0.0-M6 |
Affected products
- codecentric spring-boot-admin
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/codecentric/spring-boot-admin/commit/c14c3ec12533f71f84de9ce3ce5ceb7991975f75
patch, third-party-advisory
-
github.com
/codecentric/spring-boot-admin/security/advisories/GHSA-w3x5-427h-wfq6
web, mitigation, third-party-advisory
-
github.com
/codecentric/spring-boot-admin
package
Sources
- CVE List CVE-2022-46166
- GitHub Advisory GHSA-w3x5-427h-wfq6
- NVD CVE-2022-46166
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.