PT-2020-7548

CVE-2013-6430

Published

2014-02-25

Updated

2022-05-05

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Spring Framework versions prior to 3.2.2

Description: The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via specific Unicode characters, including line separator, paragraph separator, left angle bracket, or right angle bracket, due to improper escaping by the javascriptEscape method in JavaScriptUtils.java.

Recommendations: For versions prior to 3.2.2, update to version 3.2.2 or later to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Arun Neelicattu

Jon Passki

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers