Lucene search
Redhat.comRH:CVE-2017-8039HistorySep 22, 2017 - 8:49 a.m.
CVE-2017-8039
2017-09-2208:49:30
redhat.com
access.redhat.com
14
0.259 Low
EPSS
Percentile
96.7%
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to ‘false’) can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.
Related
prion
prion
Design/Logic Flaw
2017-11-27 10:29:00
Design/Logic Flaw
2017-06-13 06:29:00
osv
osv
CVE-2017-8039
2017-11-27 10:29:00
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
2022-05-13 01:47:15
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
2022-05-13 01:45:59
nessus
nessus
RHEL 7 : spring-webflow (Unpatched Vulnerability)
2024-05-11 00:00:00
RHEL 7 : jasperreports-server-pro (Unpatched Vulnerability)
2024-06-03 00:00:00
cve
cve
CVE-2017-8039
2017-11-27 10:29:00
CVE-2017-4971
2017-06-13 06:29:00
nvd
nvd
CVE-2017-8039
2017-11-27 10:29:00
CVE-2017-4971
2017-06-13 06:29:00
cvelist
cvelist
CVE-2017-8039
2017-11-27 10:00:00
CVE-2017-4971
2017-06-13 06:00:00
github
github
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
2022-05-13 01:47:15
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
2022-05-13 01:45:59
ibm
ibm
veracode
veracode
Data Binding Expression Vulnerability
2017-09-18 04:54:49
Data Binding Expression Vulnerability
2017-06-06 03:27:56
myhack58
myhack58
seebug
seebug
Pivotal Spring Web Flow Security Bypass Vulnerability(CVE-2017-4971)
2017-06-12 00:00:00
checkpoint_advisories
checkpoint_advisories
Spring Web Flow SPEL Command Injection (CVE-2017-4971) - Ver2
2018-04-11 00:00:00
redhatcve
redhatcve
CVE-2017-4971
2017-06-01 07:19:48