| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework:spring-web | < 3.2.2.RELEASE | 3.2.2.RELEASE |
| spring framework | ≥ 3.0.0, < 3.2.2 | 3.2.2 |
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free