Possible XSS when using Spring MVC

LOW | JANUARY 14, 2014 | CVE-2013-6430

Description

The JavaScriptUtils.javaScriptEscape() method did not escape all characters that are sensitive within either a JS single quoted string, JS double quoted string, or HTML script data context. In most cases this will result in an unexploitable parse error but in some cases it could result in an XSS vulnerability.

Affected Spring Products and Versions

Spring Framework:

3.2.1 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Fix version	Availability
3.2.2	OSS

No further mitigation steps are necessary.

Credit

This issue was originally reported to the Spring Framework developers by Jon Passki and the security implications brough to the attention of the Pivotal security team by Arun Neelicattu.