PT-2020-7548 · Unknown · Spring Framework

Arun Neelicattu + 1 · Published 2014-02-25 · Updated 2022-05-05 · CVE-2013-6430

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Spring Framework versions prior to 3.2.2

Description: The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via specific Unicode characters, including line separator, paragraph separator, left angle bracket, or right angle bracket, due to improper escaping by the javascriptEscape method in JavaScriptUtils.java.

Recommendations: For versions prior to 3.2.2, update to version 3.2.2 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-6430

DSA-2857-1

GHSA-XJRF-8X4F-43H4

MGASA-2014-0096

Affected Products

Spring Framework

References · 21

• https://github.com/spring-projects/spring-framework/commit/7a7df6637478607bef0277bf52a4e0a03e20a248 · Patch
• https://cve.org/CVERecord?id=CVE-2013-6430 · Security Note
• https://ubuntu.com/security/CVE-2013-6430 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-6430 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6430 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6430 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-6430 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0096 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xjrf-8x4f-43h4 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0096.html · Security Note
• https://github.com/spring-projects/spring-framework · Note
• https://github.com/spring-projects/spring-framework/commit/f5c9fe69a444607af667911bd4c5074b5b073e7b · Note
• https://github.com/spring-projects/spring-framework/issues/14617 · Note
• https://github.com/spring-projects/spring-framework/commit/9982b4c01a8c7be0961e58b58ed83731c40449ff · Note