An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., …
Medium CVSS 5.9
Summary
An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- http://www.securityfocus.com/bid/98785 Third Party Advisory
- https://jira.spring.io/browse/SWF-1700 Issue Tracking
- https://pivotal.io/security/cve-2017-4971 Mitigation
- http://www.securityfocus.com/bid/98785 Third Party Advisory
- https://jira.spring.io/browse/SWF-1700 Issue Tracking
- https://pivotal.io/security/cve-2017-4971 Mitigation
Timeline
- nvd_ingest NVD