CVE-2013-6430
Medium
Description
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
SeverityMedium
CVSS5.4
Exploit probability—
ProductPivotal Software Spring Framework
PublishedJan 10, 2020
First seenJan 10, 2020
How to fix
Update
- pivotal_software spring_framework3.2.2 or later
- org.springframework:spring-web3.2.2.RELEASE or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivotal_software spring_framework | 3.0.0 ≤ v < 3.2.2 | 3.2.2 |
| org.springframework:spring-webMaven | v < 3.2.2.RELEASE | 3.2.2.RELEASE |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.