Spring Framework Cross-Site Scripting Vulnerability via JSP Form Tag Attributes

A cross-site scripting (XSS) vulnerability has been identified in Spring MVC applications that use user-supplied values in the 'cssClass', 'cssErrorClass', or 'cssStyle' attributes of JSP form tags. This issue allows for the injection of arbitrary HTML or JavaScript, potentially leading to XSS attacks. The vulnerability affects multiple versions of the Spring Framework, including 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.

Impact

Exploitation of this vulnerability allows for cross-site scripting attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users should upgrade to Spring Framework versions 7.0.8, 6.2.19, 6.1.28, or 5.3.49. Instructions for obtaining these versions are available on the Spring Enterprise website.