| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.webflow:spring-webflow | ≥ 3.0.0, < 3.0.2≥ 4.0.0, < 4.0.1≤ 2.5.1 | 3.0.24.0.1 |
| spring web flow | = 4.0.0≥ 3.0.0, < 3.0.1.1< 2.5.2 | 3.0.1.12.5.2 |
Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker.
Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free