Lucene search
Veracode Vulnerability DatabaseVERACODE:4374HistoryJun 06, 2017 - 3:27 a.m.
Data Binding Expression Vulnerability
2017-06-0603:27:56
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
8
0.259 Low
EPSS
Percentile
96.7%
Spring Web Flow is vulnerable to a data binding expression vulnerability. The vulnerability is possible because the MvcViewFactoryCreator useSpringBinding property is set to false by default. Therefore, the applications which use the default settings are vulnerable to malicious EL expressions in view states, allowing form submissions from setting fields on the target object that should not be set.
| CPE | Name | Operator | Version |
|---|---|---|---|
| spring web flow | le | 2.4.4.RELEASE |
Related
osv
osv
CVE-2017-4971
2017-06-13 06:29:00
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
2022-05-13 01:45:59
CVE-2017-8039
2017-11-27 10:29:00
prion
prion
Design/Logic Flaw
2017-06-13 06:29:00
Design/Logic Flaw
2017-11-27 10:29:00
myhack58
myhack58
cve
cve
CVE-2017-4971
2017-06-13 06:29:00
CVE-2017-8039
2017-11-27 10:29:00
seebug
seebug
Pivotal Spring Web Flow Security Bypass Vulnerability(CVE-2017-4971)
2017-06-12 00:00:00
checkpoint_advisories
checkpoint_advisories
Spring Web Flow SPEL Command Injection (CVE-2017-4971) - Ver2
2018-04-11 00:00:00
cvelist
cvelist
CVE-2017-4971
2017-06-13 06:00:00
CVE-2017-8039
2017-11-27 10:00:00
redhatcve
redhatcve
CVE-2017-4971
2017-06-01 07:19:48
CVE-2017-8039
2017-09-22 08:49:30
nvd
nvd
CVE-2017-4971
2017-06-13 06:29:00
CVE-2017-8039
2017-11-27 10:29:00
github
github
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
2022-05-13 01:45:59
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
2022-05-13 01:47:15
nessus
nessus
RHEL 7 : spring-webflow (Unpatched Vulnerability)
2024-05-11 00:00:00
RHEL 7 : jasperreports-server-pro (Unpatched Vulnerability)
2024-06-03 00:00:00
