Published: 10/01/2020 Updated: 22/01/2020

CVSS v2 Base Score: 3.5 | Impact Score: 2.9 | Exploitability Score: 6.8

CVSS v3 Base Score: 5.4 | Impact Score: 2.7 | Exploitability Score: 2.3

VMScore: 312

Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework prior to 3.2.2 does not properly escape certain characters, which allows remote malicious users to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pivotal software spring framework

Debian Bug report logs - #741604 libspring-java: Multiple security issues Package: libspring-java; Maintainer for libspring-java is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Fri, 14 Mar 2014 12:39:01 UTC Owned by: Miguel Landaeta < ...

Debian Bug report logs - #735420 libspring-java: CVE-2013-6429 CVE-2013-6430 Package: libspring-java; Maintainer for libspring-java is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Wed, 15 Jan 2014 09:36:11 UTC Owned by: Markus Koschany & ...

It was discovered by the Spring development team that the fix for the XML External Entity (XXE) Injection (CVE-2013-4152) in the Spring Framework was incomplete Spring MVC's SourceHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them SourceHttpMessageConverter has b ...

CWE-79 https://jira.springsource.org/browse/SPR-9983 http://www.gopivotal.com/security/cve-2013-6430 https://github.com/spring-projects/spring-framework/commit/7a7df6637478607bef0277bf52a4e0a03e20a248 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741604 https://www.debian.org/security/./dsa-2857

CVE-2013-6430

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect