CVE-2017-8039

moderate-risk

Published 2017-11-27

An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.

Do I need to act?

0.18% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.9/10 Medium

NETWORK / HIGH complexity

Affected Products (5)

Spring Web Flow

Affected Vendors

Pivotal

References (4)

Third Party Advisory http://www.securityfocus.com/bid/100849

Issue Tracking https://pivotal.io/security/cve-2017-8039

Third Party Advisory http://www.securityfocus.com/bid/100849

Issue Tracking https://pivotal.io/security/cve-2017-8039

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 12/34 · Low