CVE-2013-6430

2020-01-1013:28:11

redhat

www.cve.org

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.5%

JSON

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.

CNA Affected

[
  {
    "product": "Spring MVC",
    "vendor": "Pivotal",
    "versions": [
      {
        "status": "affected",
        "version": "before 3.2.2"
      }
    ]
  }
]