Read the docs
TI-2013-05383 Aliases CVE-2013-6430GHSA-xjrf-8x4f-43h4

Cross-site scripting in Pivotal Spring MVC

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 2 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.

Why it matters now

EPSS 0.01774 78th percentileScored 2026-11-07
Fix Partial Spring MVC (Pivotal): 3.2.2org.springframework:spring-web (Maven): 3.2.2.RELEASERed Hat: 2 advisoriesRed Hat: 2 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PivotalSpring MVCbefore 3.2.23.2.2Patch availableCNA
—org.springframework:spring-web (Maven)before 3.2.2.RELEASE3.2.2.RELEASEPatch availableGHSA-xjrf-8x4f-43h4
  • Spring MVC VendorPivotal Affected before 3.2.2 Fixed in 3.2.2 Patch available CNA
  • org.springframework:spring-web (Maven) Vendor— Affected before 3.2.2.RELEASE Fixed in 3.2.2.RELEASE Patch available GHSA-xjrf-8x4f-43h4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*3.0.0 to before 3.2.2VulnerableSpring by Pivotal
  • cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.2.2 Vulnerable ·Spring by Pivotal

Remediation

  • Fix · CNA Spring MVC (Pivotal) Fixed in 3.2.2
  • Fix · GHSA-xjrf-8x4f-43h4 org.springframework:spring-web (Maven) Fixed in 3.2.2.RELEASE Advisory →

Red Hat 2 advisories

  • RHSA-2014:0400 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss Fuse 6.1.0 update
    • Red Hat JBoss Fuse 6.1
  • RHSA-2014:0401 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss A-MQ 6.1.0 update
    • Red Hat JBoss A-MQ 6.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 4AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Will not fix
Red Hat JBoss Portal 5AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 4AffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6.1Fixed RHSA-2014:0401
Red Hat JBoss Fuse 6.1Fixed RHSA-2014:0400

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-6430
  2. 2026-10-03 Alias added: GHSA-xjrf-8x4f-43h4

References

Patch 1

Advisory 3

Other 6

  • TI-2017-05637 Improper input validation in Pivotal Spring Data REST and Spring Boot CVSS 3.0CRITICAL 9.8
  • TI-2016-04299 When processing authorization requests using the whitelabel views in Spring Security… CVSS 3.0HIGH 8.8
  • TI-2018-01165 Code injection in Pivotal Spring Security OAuth CVSS 3.0CRITICAL 9.8
  • TI-2018-11237 DoS Attack via Range Requests CVSS 3.1HIGH 7.5
  • TI-2019-02791 Apps Manager unverified SSL certs in Cloud Controller proxy CVSS 3.0CRITICAL 9.8
  • TI-2018-11239 On Demand Services SDK Timing Attack Vulnerability CVSS 3.0CRITICAL 9.8
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences