CVE-2017-4971
MediumCVSS 5.9Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property (disabled by default) can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.
Risk Assessment
Risk of executing malicious EL expressions, potentially leading to remote code execution or unauthorized data access.
Recommendation
Recommend setting the useSpringBinding property to 'true' or explicitly defining data binding property mappings in view states that process forms.
Other vulnerabilities in Spring Web Flow
See all- CVE-2026-40986Medium
Vulnerability in Spring Web Flow where the JavaScript RemotingHandler renders the error response body as HTML even when the response is not 'text/html'. This can lead to a scripting attack in the user's browser if the error response contains attacker-reflected data. Affects versions 4.0.0, 3.0.0-3.0.1, 2.5.0-2.5.1.
- CVE-2026-40985Medium
Applications that configure WebFlowELExpressionParser are vulnerable to malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0, 3.0.0-3.0.1, and 2.5.0-2.5.1.
- CVE-2017-8039Medium
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property (disabled by default) can be vulnerable to malicious EL expressions in view states that process form submissions without explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.
Original NVD description (English source)
An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.