VULNERABILITY INTELLIGENCE

CVE-2017-4971

CVSS score5.9 MEDIUM

EPSS probability14.69%

CISA KEVNot currently listed

Published2017-06-13

Last modified2026-09-08

CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.

Weakness classification

CWE-1188: Initialization of a Resource with an Insecure Default

Primary references

security_alert@emc.com — Third Party Advisory, VDB Entry
security_alert@emc.com — Issue Tracking, Patch
security_alert@emc.com — Mitigation, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Patch, Vendor Advisory