[GHSA-xjrf-8x4f-43h4] Improper Neutralization of Input During Web Page Generation in Spring Framework

[poc-effectiveness]

Updates

• Affected products

Comments
We are writing to request an update to the affected version range for CVE-2013-6430 in the GitHub Advisory Database.

According to the official NVD listing:
🔗 https://nvd.nist.gov/vuln/detail/CVE-2013-6430

The vulnerability affects Spring Framework before 3.2.2.

However, the current GitHub advisory version range only covers:

= 3.0.0.RELEASE and <= 3.2.1.RELEASE

This range omits earlier vulnerable versions prior to 3.0.0, such as those from the 1.x and 2.x branches, which are also affected.

We have validated this through manual testing, and to support this claim, we have provided working PoCs:

For versions 1.2.1 through 1.2.4:
🔗 https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2013-6430

For other affected versions:
🔗 https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2013-6430/exploit

[advisory-database]

Hi @poc-effectiveness! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!