Vulnerability Report

CVE-2017-4971

Title: Pivotal Spring Web Flow

Other

Proof Of Concept

No public PoC currently indexed for CVE-2017-4971.

CWE Category CWE-1188

Published Date Jun 13, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 5.9 CVSS v3.0

Exploit Probability (EPSS)

15.86%

Vulnerability Summary

CVE-2017-4971: An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.

Impacted Vendors

pivotal 1

Reference Links

http://www.securityfocus.com/bid/98785 https://jira.spring.io/browse/SWF-1700 https://pivotal.io/security/cve-2017-4971 http://www.securityfocus.com/bid/98785 https://jira.spring.io/browse/SWF-1700 https://pivotal.io/security/cve-2017-4971

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

5.9

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns