CyberRota Analysis
AI-GeneratedSpring MVC and WebFlux applications that utilize the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors with HTML escaping enabled are susceptible to arbitrary HTML/JavaScript code injection, leading to potential reflected cross-site scripting (XSS) vulnerabilities. This affects multiple versions of the Spring Framework, specifically from 5.2.25.RELEASE up to 7.0.8. Organizations using these versions should prioritize remediation to mitigate the risk of XSS attacks.
Original NVD Description
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
Related CVEs
Other vulnerabilities affecting the same vendor(s)