Improper Encoding or Escaping of Output Affecting thingsboard package, versions <4.0.1-r1


Severity

Recommended
0.0
critical
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.07% (24th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-THINGSBOARD-10175950
  • published15 May 2025
  • disclosed28 Apr 2025

Introduced: 28 Apr 2025

CVE-2025-31651  (opens in a new tab)
CWE-116  (opens in a new tab)

How to fix?

Upgrade Chainguard thingsboard to version 4.0.1-r1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream thingsboard package and not the thingsboard package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

CVSS Base Scores

version 3.1