Improper Neutralization of Input During Web Page Generation in Spring Framework

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2013-6430 · ADVISORY
• spring-projects/spring-framework · WEB
• spring-projects/spring-framework commit 7a7df66 · WEB
• spring-projects/spring-framework commit 9982b4c · WEB
• spring-projects/spring-framework commit f5c9fe6 · WEB
• spring-projects/spring-framework · PACKAGE
• jira.spring.io/browse/SPR-9983 · WEB
• spring.io/security/cve-2013-6430 · WEB
• gopivotal.com/security/cve-2013-6430 · Third Party Advisory
• jira.springsource.org/browse/SPR-9983 · Third Party Advisory

org.springframework:spring-web のその他の脆弱性

• CVE-2026-41854中 6.5Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be…
• CVE-2025-41234中 6.5Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file dow…
• CVE-2024-38820中 5.3The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale depe…
• CVE-2024-38809中 5.3Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions s…
• CVE-2024-22262高 8.1Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation check…