cveboard RSS feed

CVE-2017-8039

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2017
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected

Vendor
n/a
Product
Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected
Platforms
Unknown
Default status
Unknown
Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affectedaffectedUnavailableUnavailableUnavailableNone listed