Spring Framework Cross-Site Scripting Vulnerability via JavaScript Escape Function

A cross-site scripting (XSS) vulnerability has been identified in Spring Framework versions 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48. This vulnerability arises from improper escaping in the 'JavaScriptUtils.javaScriptEscape()' function, which can lead to JavaScript code injection in the browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users should upgrade to Spring Framework versions 7.0.8, 6.2.19, 6.1.28, or 5.3.49. Instructions for accessing these versions are available on the Spring Enterprise website.