CVE-2017-8039
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
Also known as GHSA-q4v9-qjmw-j7vf
Published 8 y ago · modified 59 d ago · JSON
Summary
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.
Exploit prediction (EPSS)
1.13% probability of exploitation in the next 30 days, higher than 67% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.webflow:spring-webflow | <2.4.6 | 2.4.6 |
Affected products
- n/a Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected
Classification
- Weakness
- CWE-1188 Initialization of a Resource with an Insecure Default
References
- pivotal.io /security/cve-2017-8039 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/100849 · vdb-entry, x_refsource_BID, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-8039 · advisory
Sources
- CVE List: CVE-2017-8039
- GitHub Advisory: GHSA-q4v9-qjmw-j7vf
- NVD: CVE-2017-8039
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.