CVE-2017-4971

medium · 5.9

An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.

5.9

CVSS

16.8%

EPSS (exploit prob.)

97th

EPSS percentile

2017-06-13

Published

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses

CWE-1188

Affected products

Vendor	Product	Affected versions
broadcom	spring_web_flow	2.4.0
broadcom	spring_web_flow	2.4.1
broadcom	spring_web_flow	2.4.2
broadcom	spring_web_flow	2.4.4

Check a specific version with /api/v1/cve/match.

References

http://www.securityfocus.com/bid/98785
https://jira.spring.io/browse/SWF-1700
https://pivotal.io/security/cve-2017-4971
http://www.securityfocus.com/bid/98785
https://jira.spring.io/browse/SWF-1700
https://pivotal.io/security/cve-2017-4971

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-4971