Описание
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Отчет
The Red Hat Security Response Team has rated this issue as having Moderate security impact. OpenShift Enterprise 1 is currently in the Production 1 phase of its lifecycle, as such this issue is not currently planned to be addressed in future updates. For additional information, refer to the Satellite Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift page. Fuse ESB Enterprise is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Enterprise 1 | spring-web | Will not fix | ||
| Red Hat Enterprise Virtualization 3 | jasperreports-server-pro | Not affected | ||
| Red Hat JBoss Enterprise Web Server 1 | all | Not affected | ||
| Red Hat JBoss Enterprise Web Server 1 | fuse-esb-enterprise-7 | Will not fix | ||
| Red Hat JBoss Enterprise Web Server 1 | fuse-management-console-7 | Will not fix | ||
| Red Hat JBoss Enterprise Web Server 1 | fuse_mq_apache | Affected | ||
| Red Hat JBoss Enterprise Web Server 1 | fuse-mq-enterprise-7 | Will not fix | ||
| Red Hat JBoss Enterprise Web Server 1 | jboss_amq | Affected | ||
| Red Hat JBoss Enterprise Web Server 1 | jboss_fuse | Affected | ||
| Red Hat OpenShift Enterprise 2 | spring-web | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS2
Связанные уязвимости
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/Form ...
Improper Neutralization of Input During Web Page Generation in Spring Framework
EPSS
4.3 Medium
CVSS2