Skip to content
CVE Tracker
Back

CVE-2017-8039

An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator…

Medium5.9EPSS 1.1%
Published
Updated
Reserved
Assigned by
dell

Description

An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.

Scores

CVSS scores of CVE-2017-8039, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0Medium5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS (exploitation in 30 days)
1.1% · top 33% of all CVEs (3 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

Affected products

  • Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected

    • affected Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected

Affected packages

From reviewed advisories of the GitHub Advisory Database.

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .