Description
This Spring web application is configured to disable the automatic HTML escaping for Spring tags which may lead to Cross-Site Scripting vulnerabilities.
Remediation
It's recommended to enable HTML escaping for Spring tags. This can be configured from web.xml like in the example below:
<web-app>
...
<context-param>
<param-name>defaultHtmlEscape</param-name>
<param-value>true</param-value>
</context-param>
...
</web-app>
At page level, it is defined as a tag-declaration.
<spring:htmlEscape defaultHtmlEscape="true" />
References
Related Vulnerabilities
WordPress Plugin Ceceppa Multilingua Multiple Cross-Site Scripting Vulnerabilities (1.5.13)
WordPress Plugin Testimonials Widget Cross-Site Scripting (3.5.1)
WordPress Plugin Open Graph for Facebook, Google+ and Twitter Card Tags Cross-Site Scripting (2.2.4)
WordPress Plugin MetaSlider Cross-Site Scripting (3.17.1)
WordPress Plugin Social Like Box and Page by WpDevArt Cross-Site Scripting (0.8.40)