CVE-2013-6430: XSS
It was found that the org.spring.web.util.JavaScriptUtils.javaScriptEscape method insufficiently escaped some characters. Applications using this method to escape user-supplied content that will be rendered in HTML 5 documents may expose cross-site scripting (XSS) flaws.
Other sources
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6430?
CVE-2013-6430 is considered a high severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2013-6430?
To fix CVE-2013-6430, upgrade to Spring Framework version 3.2.2.RELEASE or later.
What applications are affected by CVE-2013-6430?
CVE-2013-6430 affects applications using org.springframework:spring-web versions between 3.0.0.RELEASE and 3.2.1.RELEASE.
What type of vulnerability is CVE-2013-6430?
CVE-2013-6430 is a cross-site scripting (XSS) vulnerability.
Is CVE-2013-6430 present in the latest Spring releases?
No, CVE-2013-6430 is not present in the latest releases beyond version 3.2.1.RELEASE.