Improper Neutralization of Input During Web Page Generation in Spring Framework
Moderate severity
GitHub Reviewed
Published
May 14, 2022
to the GitHub Advisory Database
•
Updated Mar 5, 2024
Package
Affected versions
>= 3.0.0, <= 3.2.7.RELEASE
>= 4.0.0, <= 4.0.1.RELEASE
Patched versions
3.2.8.RELEASE
4.0.2.RELEASE
Description
Published by the National Vulnerability Database
Mar 20, 2014
Published to the GitHub Advisory Database
May 14, 2022
Reviewed
Jul 7, 2022
Last updated
Mar 5, 2024
Credits
-
sunSUNQ Analyst
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
References