CVE-2013-6430

Improper Neutralization of Input During Web Page Generation in Spring Framework

5.4 MediumFix available

CVE-2013-6430 is a medium vulnerability (CVSS 5.4) in Pivotal Spring Mvc, published February 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.77%, the 78th percentile. Fixed in org.springframework:spring-web 3.2.2.RELEASE.

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.77%Up 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 5.4

Record: CVE-2013-6430
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-6430
Updated: 2026-11-02

EUVDEUVD-2022-5814 No score

Record: EUVD-2022-5814
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xjrf-8x4f-43h4 5.4

Improper Neutralization of Input During Web Page Generation in Spring Framework

Record: GHSA-xjrf-8x4f-43h4
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 5.4

Record: CVE-2013-6430
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-6430 5.4

Record: DEBIAN-CVE-2013-6430
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Show 5 moreShow less

OSVGHSA-xjrf-8x4f-43h4 5.4

Improper Neutralization of Input During Web Page Generation in Spring Framework

Record: GHSA-xjrf-8x4f-43h4
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-6430 5.4

Record: UBUNTU-CVE-2013-6430
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVCLSA-2025-1760313986 No score

TuxCare security update for org.springframework (29 CVEs)

TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.

Record: CLSA-2025-1760313986
Updated: 2026-11-02

OSVCLSA-2026-1779238042 No score

TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 2 org.springframework packages to address 3 CVEs. Fixed in 3.0.5.RELEASE-tuxcare.1.

Record: CLSA-2026-1779238042
Updated: 2026-11-02

OSVMGASA-2014-0096 No score

Updated springframework package fixes security vulnerabilities

It was discovered by the Spring development team that the fix for the XML External Entity (XXE) Injection (CVE-2013-4152) in the Spring Framework was incomplete. Spring MVC's SourceHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. SourceHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default (CVE-2013-6429).

In addition Jon Passki discovered a possible XSS vulnerability: The JavaScriptUtils.javaScriptEscape() method did not escape all characters that are sensitive within either a JS single quoted string, JS double quoted string, or HTML script data context. In most cases this will result in an unexploitable parse error but in some cases it could result in an XSS vulnerability (CVE-2013-6430).

Record: MGASA-2014-0096
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework:spring-web` Maven	through 3.2.1.RELEASE	3.2.2.RELEASE
`org.springframework:spring-beans` TuxCare:Maven	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-context` TuxCare:Maven	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-core` TuxCare:Maven	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-oxm` TuxCare:Maven	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven	3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1	3.1.1.RELEASE-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven	3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.1	3.0.5.RELEASE-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven	3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.1	3.0.5.RELEASE-tuxcare.1

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`libspring-java` Debian:12	before 3.0.6.RELEASE-11	3.0.6.RELEASE-11
`libspring-java` Debian:13	before 3.0.6.RELEASE-11	3.0.6.RELEASE-11
`libspring-java` Debian:14	before 3.0.6.RELEASE-11	3.0.6.RELEASE-11
`libspring-java` Debian:7	before 3.0.6.RELEASE-6+deb7u2, plus listed versions 3.0.6.RELEASE-63.0.6.RELEASE-6+deb7u1	3.0.6.RELEASE-6+deb7u2
`org.springframework:spring-web` Maven	before 3.2.2.RELEASE, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less 1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE	3.2.2.RELEASE
`springframework` Mageia:3	before 3.1.1-21.2.mga3	3.1.1-21.2.mga3
`springframework` Mageia:4	before 3.1.4-2.1.mga4	3.1.4-2.1.mga4