5.9med
CVE-2017-4971
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
Also known as GHSA-fg9w-cffm-pmh2
Published 9 y ago · modified 59 d ago · JSON
CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
14.7%
percentile 97%
Public exploits
0
none known
Summary
An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.
Exploit prediction (EPSS)
14.69% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.webflow:spring-webflow | >=2.4.0, <2.4.5 | 2.4.5 |
Affected products
- n/a Spring Web Flow
Classification
- Weakness
- CWE-1188 Initialization of a Resource with an Insecure Default
References
- securityfocus.com /bid/98785 · vdb-entry, x_refsource_BID, x_transferred
- pivotal.io /security/cve-2017-4971 · x_refsource_CONFIRM, x_transferred
- jira.spring.io /browse/SWF-1700 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-4971 · advisory
Sources
- CVE List: CVE-2017-4971
- GitHub Advisory: GHSA-fg9w-cffm-pmh2
- NVD: CVE-2017-4971
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.