CVE-2013-6430
Improper Neutralization of Input During Web Page Generation in Spring Framework
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
- Record
CVE-2013-6430- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
- Record
CVE-2013-6430- Updated
- 2026-11-02
EUVDEUVD-2022-5814 No score
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
- Record
EUVD-2022-5814- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xjrf-8x4f-43h4
Improper Neutralization of Input During Web Page Generation in Spring Framework
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
- Record
GHSA-xjrf-8x4f-43h4- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
- Record
CVE-2013-6430- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6430
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
- Record
DEBIAN-CVE-2013-6430- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-xjrf-8x4f-43h4
Improper Neutralization of Input During Web Page Generation in Spring Framework
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
- Record
GHSA-xjrf-8x4f-43h4- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6430
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
- Record
UBUNTU-CVE-2013-6430- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2025-1760313986 No score
TuxCare security update for org.springframework (29 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313986- Updated
- 2026-11-02
OSVCLSA-2026-1779238042 No score
TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 3 CVEs. Fixed in 3.0.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1779238042- Updated
- 2026-11-02
OSVMGASA-2014-0096 No score
Updated springframework package fixes security vulnerabilities
It was discovered by the Spring development team that the fix for the XML External Entity (XXE) Injection (CVE-2013-4152) in the Spring Framework was incomplete. Spring MVC's SourceHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. SourceHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default (CVE-2013-6429).
In addition Jon Passki discovered a possible XSS vulnerability: The JavaScriptUtils.javaScriptEscape() method did not escape all characters that are sensitive within either a JS single quoted string, JS double quoted string, or HTML script data context. In most cases this will result in an unexploitable parse error but in some cases it could result in an XSS vulnerability (CVE-2013-6430).
- Record
MGASA-2014-0096- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webMaven |
through 3.2.1.RELEASE | 3.2.2.RELEASE |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-oxmTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 3 CVEs |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.1 | 3.0.5.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 3 CVEs |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.1 | 3.0.5.RELEASE-tuxcare.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libspring-javaDebian:12 |
before 3.0.6.RELEASE-11 | 3.0.6.RELEASE-11 |
libspring-javaDebian:13 |
before 3.0.6.RELEASE-11 | 3.0.6.RELEASE-11 |
libspring-javaDebian:14 |
before 3.0.6.RELEASE-11 | 3.0.6.RELEASE-11 |
libspring-javaDebian:7 From an advisory covering 2 CVEs |
before 3.0.6.RELEASE-6+deb7u2, plus listed versions 3.0.6.RELEASE-63.0.6.RELEASE-6+deb7u1 |
3.0.6.RELEASE-6+deb7u2 |
org.springframework:spring-webMaven |
before 3.2.2.RELEASE, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE |
3.2.2.RELEASE |
springframeworkMageia:3 From an advisory covering 2 CVEs |
before 3.1.1-21.2.mga3 | 3.1.1-21.2.mga3 |
springframeworkMageia:4 From an advisory covering 2 CVEs |
before 3.1.4-2.1.mga4 | 3.1.4-2.1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| affected | OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6430 is a medium vulnerability (CVSS 5.4) in Pivotal Spring Mvc, published February 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.77%, the 78th percentile. Fixed in org.springframework:spring-web 3.2.2.RELEASE.
References
gopivotal.com/security/cve-2013-6430
github.com/spring-projects/spring-framework/commit/7a7df6637478607bef0277bf52a4e0a03e20a248
jira.springsource.org/browse/SPR-9983
nvd.nist.gov/vuln/detail/CVE-2013-6430
Show 11 moreShow less
jira.spring.io/browse/SPR-9983?redirect=false
spring.io/security/cve-2013-6430
security-tracker.debian.org/tracker/CVE-2013-6430
advisories.mageia.org/MGASA-2014-0096.html
bugs.mageia.org/show_bug.cgi?id=12707
debian.org/security/2014/dsa-2857
ubuntu.com/security/CVE-2013-6430
cve.org/CVERecord?id=CVE-2013-6430
Left out here: 14 versions. The JSON record has them.