CVE-2013-6430

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.

• CWE-79

• http://www.gopivotal.com/security/cve-2013-6430Third Party Advisory
• https://github.com/spring-projects/spring-framework/commit/7a7df6637478607bef0277bf52a4e0a03e20a248Patch, Third Party Advisory
• https://jira.springsource.org/browse/SPR-9983Third Party Advisory
• http://www.gopivotal.com/security/cve-2013-6430Third Party Advisory
• https://github.com/spring-projects/spring-framework/commit/7a7df6637478607bef0277bf52a4e0a03e20a248Patch, Third Party Advisory
• https://jira.springsource.org/browse/SPR-9983Third Party Advisory

Published

Jan 10, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-6424Integer underflow in the xTrapezoidValid macro in render/pic…
• CVE-2013-6425Integer underflow in the pixman_trapezoid_valid macro in pix…
• CVE-2013-6426The cloudformation-compatible API in OpenStack Orchestration…
• CVE-2013-6427upgrade.py in the hp-upgrade service in HP Linux Imaging and…
• CVE-2013-6428The ReST API in OpenStack Orchestration API (Heat) before Ha…
• CVE-2013-6429The SourceHttpMessageConverter in Spring MVC in Spring Frame…
• CVE-2013-6431The fib6_add function in net/ipv6/ip6_fib.c in the Linux ker…
• CVE-2013-6432The ping_recvmsg function in net/ipv4/ping.c in the Linux ke…
• CVE-2013-6433The default configuration in the Red Hat openstack-neutron p…
• CVE-2013-6434The remote-viewer in Red Hat Enterprise Virtualization Manag…
• CVE-2013-6435Race condition in RPM 4.11.1 and earlier allows remote attac…
• CVE-2013-6436The lxcDomainGetMemoryParameters method in lxc/lxc_driver.c …