Vulnerability Report

CVE-2017-8039

Title: Pivotal Spring Web Flow

Other

Proof Of Concept

No public PoC currently indexed for CVE-2017-8039.

CWE Category CWE-1188

Published Date Nov 27, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 5.9 CVSS v3.0

Exploit Probability (EPSS)

0.96%

Vulnerability Summary

CVE-2017-8039: An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.

Impacted Vendors

pivotal 1

Reference Links

http://www.securityfocus.com/bid/100849 https://pivotal.io/security/cve-2017-8039 http://www.securityfocus.com/bid/100849 https://pivotal.io/security/cve-2017-8039

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

5.9

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns