CVE-2017-4971

State: Published
Severity: Not scored
Published: Jun 13, 2017
Updated: Aug 5, 2024
Reserved: Dec 29, 2016

Description

An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Spring Web Flown/a	Spring Web FlowAffected

References

98785vdb-entry
https://pivotal.io/security/cve-2017-4971
https://jira.spring.io/browse/SWF-1700

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.